{ "Event": { "published": true, "date": "2023-09-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-07", "timestamp": 1694131381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "94e0813b-0cd2-43f0-8df6-604ec1d210f4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7091b8-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694102702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102702, "uuid": "6c25ced9-e0b6-4829-9a56-ee75447c05e8", "comment": "Malware payload", "value": "85361b17a9f1991ea028ee143f336926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102702, "uuid": "fe9dc2ec-9c90-4317-ad02-f5be04a7089c", "comment": "Malware payload", "value": "005fcb05a2b33f403a4b3e39bfc7846801aa61332d7d4c359031250aae884b0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102702, "uuid": "6b9ccc8d-60ff-4785-b4be-ce2ea67c4f9d", "comment": "Malware payload", "value": "e074d8da24531bda994659a868d794fb48041f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102702, "uuid": "7f1b4f28-fa4d-4386-aa70-ccaa2a462aa4", "comment": "Malware payload", "value": "b65549871a011555930f43f6692869bf4367be08a17236da5bcbe829d5ddbc60ff8f0acb5e8d109f27026cea2a780511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102702, "uuid": "4591f1e7-6354-422c-96ea-864f0e274885", "value": "T1F224B609AF650FFBDC6FDE3702E90A4529CC650722A43B3A3674D528F54A94F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102702, "uuid": "a44097b6-2d1e-42e0-97c6-2086d877a044", "value": "1536:lZAiz/XHe6ijtDHy2QkmjP3vebR/EvnPEKjNTY6aVnfNeZz9wnzJwu2blM3gHRbX:lCYiHypXR1apUyO2gHzgh3gUO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102702, "uuid": "9cb01030-90e5-4ba4-b060-a9bad4df04e8", "value": 210840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102702, "uuid": "2ef23274-e2a5-49a8-a203-d0100184f6c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102702, "uuid": "c66167a9-ba15-4e41-8e68-f370a590a2ff", "value": "85361b17a9f1991ea028ee143f336926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9778a9d-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694069409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069409, "uuid": "2f7159bd-0964-406a-ac3b-65a0e1273a95", "comment": "Malware payload (Mirai)", "value": "4cd154f5415850e9ca139cfeb06c2b1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069409, "uuid": "db2b7ac8-f65e-4df3-86cb-7d48a9188874", "comment": "Malware payload (Mirai)", "value": "0089159fb49530f6e1b69db63442101becd4b6150d05c713d46031ce765e507e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069409, "uuid": "51a06eb2-3678-4a42-89b2-03fd227a3a2b", "comment": "Malware payload (Mirai)", "value": "acf843dcc1d32ec9f17843c010302f59c50fc644", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069409, "uuid": "6a40e6ca-6dbd-48cd-9ce4-0649ce5b40a7", "comment": "Malware payload (Mirai)", "value": "4af26ebe170f151bc68c0299e0b4c48ff5199eae7cc9cff8ed9f803535ba7461336e7e3ea32ae20009fdbaac93a62abd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069409, "uuid": "051a79e2-e2de-42c1-b5dc-661993584d11", "value": "T15B3302A2275D29E291B08737FC32EC1A679C16FD997730962CF0A91977C48024FF16C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069409, "uuid": "89bf9ab3-4ab0-458b-b48c-83c905b8d473", "value": "1536:j9O/ZMAXIxNUk0qiLcPqF1aBexo4opKZbU:j9O/ZNKyuiLGqFUFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069409, "uuid": "7e0e0840-e0f4-4d27-a2eb-5eb4db0d8099", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069409, "uuid": "3eee5f2f-27d2-40f1-bcd1-0c261b199a1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069409, "uuid": "6d773fd8-df36-4185-93c6-72c9cec83c97", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c94e0b-4d9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694105407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105407, "uuid": "f8765ce0-692e-4a54-ab8d-9f07bb8cb76e", "comment": "Malware payload (Mirai)", "value": "366cbf0b3d806ff8615c2758630df576", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105407, "uuid": "4d704f1f-6c3a-4f0e-a8f1-0eb1ae8cb1f9", "comment": "Malware payload (Mirai)", "value": "008e3bc3313514008c8ce7ad31c420140957efdfee69e5681dce89b55a4db9c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105407, "uuid": "858e3e3b-82f3-4f70-915e-15d43b631760", "comment": "Malware payload (Mirai)", "value": "040aaa00869053c429413313ccb166a410b6fafc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105407, "uuid": "c1ef17c7-8392-43fa-b9b3-bec2e3e54bd7", "comment": "Malware payload (Mirai)", "value": "1ab4d7b086fe7c805656ab7d8f052ca979912c14e23b283594657fb119b791e60afcbbbacd4f32795ae4d70cfc3336ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105407, "uuid": "9878a5dc-e476-4efe-8e13-c5cc40f54540", "value": "T161535BC9E5C3E9F4EC150E71213BEF3386B6E63D2169CF97D3A86432AA51502D21639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105407, "uuid": "50f338e7-bd5e-4173-aa2d-7b77bf2269a7", "value": "1536:nThUDbgT1fAERzrmzxwNrVIGP4JJC9jSv:2X+1fA4rmzy5IsAM9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694105407, "uuid": "7f86967b-ff0e-4b9e-b638-5a2567592900", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694105407, "uuid": "c2cbee97-374f-4229-a267-5c489e1a1462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105407, "uuid": "d37e2faa-3951-4b9f-b045-7851a344ccd8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd96db6-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075641, "uuid": "1f82e57b-5558-4478-94ab-8f2fe739487c", "comment": "Malware payload (ConnectWise)", "value": "86ee7b2b7f774eb2c961c7b920c98c81", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075641, "uuid": "656ab43d-3cd9-4a15-83ab-be8d1998db22", "comment": "Malware payload (ConnectWise)", "value": "00920e13cf90888605fe8c052b39adb4717d2d8eadfa4b5508b1639d32808a45", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075641, "uuid": "5ee1ada1-e8fc-407d-9b27-19d04b88178c", "comment": "Malware payload (ConnectWise)", "value": "2242db97c3529b0be9c6ab6c6fcb18f0c954c037", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075641, "uuid": "a98fb4f5-429f-4bac-a859-d3bcba1259cf", "comment": "Malware payload (ConnectWise)", "value": "11867531acca39685a5d99afe3b578dbb0373a4cd7db68a972086c3452081ce1d312fb911d74de957a9ebae04c5ae829", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075641, "uuid": "9389a54d-a791-4c86-b100-dac8af90fa8b", "value": "T1A8835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075641, "uuid": "02e94c34-ebd6-498d-a693-680e84632c39", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075641, "uuid": "9011afeb-3887-44f5-8f64-e66dacbe08c3", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3hk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075641, "uuid": "18205cae-6c0a-424f-b172-0562949c1615", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075641, "uuid": "d5be5668-20d6-4504-aade-76a3697f8a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075641, "uuid": "f4c569d4-8451-4e54-a008-8806d5e68bfd", "value": "86ee7b2b7f774eb2c961c7b920c98c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2bdcec-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694067939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067939, "uuid": "38d8c03b-dc7f-48fd-b3da-068747c5633c", "comment": "Malware payload", "value": "ae1104d4d07eeaf814114141efd70025", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067939, "uuid": "1725347f-4cbc-4f5e-bfa5-35ca98ad92f3", "comment": "Malware payload", "value": "00f5a5e5e54aa7c1f5f6de4d3712199e921707d893f130c4c6c3a60cfe14552c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067939, "uuid": "3fb47632-7ed2-4908-bd96-abf4c6f9b245", "comment": "Malware payload", "value": "78d1c9e88f2fc15d6d46194ac306804a6e1ae226", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067939, "uuid": "93e6ba2e-9ab4-499e-9dfe-cdb90b5e40fb", "comment": "Malware payload", "value": "be4f726a0dae486c0a361d0c50b3edd591a0f1d2c601055a2f660e4070831c6b6a0f319e6e2b11b9d8f10ea804dfc5af", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067939, "uuid": "4ec8ad5d-5d69-4ecf-9cbe-fdf52480bd1d", "value": "T113450152FBAD2A27C04D4630055BD7625D3ADD12EA66822B73CD3E397F787207E07A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067939, "uuid": "64876c47-a4bd-4435-afaa-971a1003a93b", "value": "24576:QO58xO+fTvocrRFjySN3t5v0JfuWT6bLneW8wKxsSUpVD3cJ9fSuYSZSbACkFMEY:j4OYTvoYzjykt5v0tuWubLneW8wmsSUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067939, "uuid": "8c9d51f0-ede4-4c7b-b9de-13d717ebc931", "value": 1272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067939, "uuid": "c0311fb5-1223-4b46-b9bc-47357c2429e1", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067939, "uuid": "18e8db61-ccab-42bd-a25c-a177f01ab9c8", "value": "Hull & East Yorkshire Events - September 2023 Monthly Planner - (Not Complete Working Progress).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e63d3-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103737, "uuid": "d8094e8c-89ea-409f-b6fe-b7b016225b0f", "comment": "Malware payload (AgentTesla)", "value": "518d102741a00dcea7c45b7f056c138a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103737, "uuid": "02682e8c-8907-4c95-8f94-f5c34b30b4f2", "comment": "Malware payload (AgentTesla)", "value": "00f9a0e9d500d85a1a380a015b722b67947a10b7bc22ad583b60a249f82a74db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103737, "uuid": "55eafb37-c922-4c96-9aa4-a35e000cc8cc", "comment": "Malware payload (AgentTesla)", "value": "2372e60665b498f0e8c2ced372d29b0b764d21ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103737, "uuid": "2e223fd6-9e47-493a-af64-1c70d04609de", "comment": "Malware payload (AgentTesla)", "value": "284c6338730b25e0b78246b5a8ca9fb955b8ac97cfb5f45f06fa7627964e4759f081e341ad86c7e176bddc8ab386d97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103737, "uuid": "7e70e1dd-4218-434a-92d9-e9c80834dd49", "value": "T100C4DEF89061C7E6E3B46BFF04A790349A67BD41607086EC377C3A884DE5AD71912E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103737, "uuid": "0789aff9-1830-4ea5-81a5-7973a6110248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103737, "uuid": "6438a37d-a819-4e6c-bd36-38cc4a706058", "value": "12288:Q5fVsbR28DjDuenGA7RZ2mXs7jM3pi8uwEVk:QtO28DjKvAtZ2m0IE3wEVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103737, "uuid": "5bb5a9ee-9c3a-4807-afb3-72f6c121ba88", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103737, "uuid": "883458d9-48f9-4790-ad5a-89d34d86c775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103737, "uuid": "48f64077-69f1-4e50-a6e7-506a45a82b47", "value": "518d102741a00dcea7c45b7f056c138a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afd00c2-4da2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694106885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106885, "uuid": "64a5e256-875c-40e2-ae65-bcece6ad6518", "comment": "Malware payload (RemcosRAT)", "value": "433633d1f979fc3855b65e600bcff5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106885, "uuid": "86a748eb-9481-4b8c-bf5e-b0052c8631bc", "comment": "Malware payload (RemcosRAT)", "value": "0103552602ac2fcc2aaa9296e00655dda0728a7d35ea079d261cda8a9341ecfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106885, "uuid": "85b567aa-485c-413c-b403-71258407bdca", "comment": "Malware payload (RemcosRAT)", "value": "154f9b23497a789262ec44ea61b998beae9b14b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106885, "uuid": "90c9d95b-1438-499d-9e28-3da0269973c3", "comment": "Malware payload (RemcosRAT)", "value": "41aab901e0f442b6c214ff421ed54d0ad52e0494b0c92ac81a4b1e7eb41319a3c3d6d50f0d0814695735f46a72e6e6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106885, "uuid": "c70a7b6a-7649-4c3a-9e8a-edd5e89f4b90", "value": "T1C935CF6AA146F6C8D46CD63914A388C581F1AE357531CE471EC1926B38FF7C0AE1EDE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106885, "uuid": "83336787-36ad-42ba-b3cf-44761b0d3f4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106885, "uuid": "f6c22edc-ba4f-4e8a-ab9b-bb76e7ffb6b0", "value": "24576:YSj4qMlpGVMSrAC2WMHmIl68fwdrAg8JHgwnZ9fL62:YdG+Sc/tl6Zd47Z9T62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694106885, "uuid": "24fb9331-dc63-41e0-801d-57c922df88fb", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694106885, "uuid": "d071949a-29b0-4b78-9d93-552f9f0f7046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106885, "uuid": "83f7c379-cfb0-4cd0-80bb-7cc4d5fcd029", "value": "y6uFd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50aa45d4-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069207, "uuid": "b48b93a5-0b24-4c76-ac77-2fbe83d447fd", "comment": "Malware payload (AgentTesla)", "value": "69dfdea8500466548e48838dccbd02c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069207, "uuid": "2a535092-4243-49ea-a3c3-b3984243c0f5", "comment": "Malware payload (AgentTesla)", "value": "011cb8c9a10fb6468b0e904cde1538c37c744e3ca3721b93c6840b64d2bc9659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069207, "uuid": "db42a0c0-b53e-4571-8cbd-038dd3581233", "comment": "Malware payload (AgentTesla)", "value": "92f0b21465fa8e09d554b9a50a717592fdbd71ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069207, "uuid": "ac5d45e8-2fad-40c1-a6a7-dee6d1a642cc", "comment": "Malware payload (AgentTesla)", "value": "d70ddf81390094cb780368660b0dfd6da36b1949c111f719172b2d1bbeac19e3af968341eb6d9e8fcefd24ad119fcff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069207, "uuid": "627ef8d3-891c-4720-a4fc-d0c65f1a7391", "value": "T139D4231261228B32D1BC83F3230A29D5A77F812A345AEB420FDAE7E9CE75F14554356B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069207, "uuid": "731b44b8-26b1-480d-99f2-8fffa6e23410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069207, "uuid": "e85b3515-1745-4be0-9163-69884e6d195f", "value": "12288:Op7zsxNTtMS0HaHvxeJZry2xnUqsEw1TSpzt2v1c5fVsbR:zNTuNHaHgJpSqyTSph2vKtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069207, "uuid": "38097746-7445-474e-a319-e379ef8aee2f", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069207, "uuid": "086c9056-b67b-47ce-a3c6-9d12c0151b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069207, "uuid": "b30adfe4-d0e4-4550-89cc-e9eecc6e8e3c", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb86b007-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103853, "uuid": "790d59c4-a3bb-4c8e-83e4-5bdb5e4f607b", "comment": "Malware payload", "value": "bf9b4c387bea933751ee72b2addfdd18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103853, "uuid": "a954dc37-f99a-4369-8192-ef182443618b", "comment": "Malware payload", "value": "0207c954948ec785a153342329641563cf14b873aa4acc862d47606e56c904b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103853, "uuid": "f988a3cc-97fb-4d36-a40e-4e1ea54ea08a", "comment": "Malware payload", "value": "262f2d91c8b6f2de3c98cd73c0ffc6732ed75ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103853, "uuid": "c5e49ee9-e9e3-4b8c-98e3-ab0c9bef5c3e", "comment": "Malware payload", "value": "9fd64f1f72d3b7cec3cc3978ae83fc6f5dd381ae01d0ebecea56ff15272dce1032f6651874e65f24b9112af5eeaf4d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103853, "uuid": "1d2fd940-633b-45f0-88f5-1d9be32c2900", "value": "T1E1E41213A7D98422D9F157B028F756E31A38BC924978836B3B46995B0CF31C4A531BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103853, "uuid": "fe24c9bf-0674-437e-b63c-13dbcfdd9ad0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103853, "uuid": "5e3b815c-0e67-4dc2-b07a-e9a43e338965", "value": "12288:9MrIy905xrQn3hOaht2owd2Og+/8KhM4awrP9k9JMZCtEX:lyQ8n3h/ht2owd2OV9P9kDcS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103853, "uuid": "fbfc16ba-638d-470e-999c-797266863fbc", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103853, "uuid": "5f1a068c-f957-4ab1-bae6-0304ee951e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103853, "uuid": "17384337-9eba-453b-a4f2-9b0306e81554", "value": "bf9b4c387bea933751ee72b2addfdd18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a01c5d-4d9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694104590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104590, "uuid": "0479fdd3-c877-4b2b-b3fa-db1244947ebc", "comment": "Malware payload", "value": "2915f6a5cf3f44365ecebbed26383863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104590, "uuid": "bb586a06-1a55-4fae-9b82-7307d8e23423", "comment": "Malware payload", "value": "025910b63a0f45eee80da7f39bb81f013b21b8386c52d9dc6f6d8a3b6105bff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104590, "uuid": "b92359b2-cfb0-41da-a38c-e66dcbea6e2b", "comment": "Malware payload", "value": "8d41ad3e3acd0053543bc62bd3634270f41b3097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104590, "uuid": "cb08ce9f-e0c4-454b-babd-bba2dfd2935a", "comment": "Malware payload", "value": "980d56f1c1ac62ca4ef7504f63ff295cde627beeae78eb0cfc476eddace364c2c99a702705d0713ae9a2ffc7cf33a374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104590, "uuid": "c7f49f9b-5040-4621-bb4d-fac754c333d1", "value": "T11FB4AD27F592F191C69301FA469EAF1A3B3AF8385325BBB392D10E592791580473EF43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104590, "uuid": "d4106b07-a6c3-4ce7-8428-b94275372d26", "value": "6144:EA7HFek44iAqppMCrhpk9GywUPlfSsfjBQ6m+i4x2qlilY8mFFzzwSEuMuJCNotk:EAt4vppME/UPl3mulBnhcSEPlHbl6lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104590, "uuid": "179c9266-9496-425b-910e-dbcc7a551e26", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104590, "uuid": "2cadbe32-e7f0-45d9-81b8-380a6da5c008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104590, "uuid": "2e99c6a0-5131-4eda-81e2-e223b7b62c4c", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.1873.19355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd4b67b-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075777, "uuid": "281e4a7f-9e23-46a8-ab8c-54c3ca832f1b", "comment": "Malware payload (ConnectWise)", "value": "eabe51d08a64413feffc9e624ef91480", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075777, "uuid": "721ac83a-82cf-43b2-a8fd-9046f8e2dd30", "comment": "Malware payload (ConnectWise)", "value": "02f738df05bad612ec1908de68ecb6c4f14ec9dfbad209e4ccf483e847d85991", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075777, "uuid": "ad6fe8ce-88bf-44c1-bcd8-5a3f7218ba0f", "comment": "Malware payload (ConnectWise)", "value": "b631ab988bfbcf39f7c69372a13f59fa32ee93d3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075777, "uuid": "b0138bc9-7709-4ebd-98df-4ee8226f08c9", "comment": "Malware payload (ConnectWise)", "value": "71f4bf28f9ad9c5cce82b9338cbaeba64021cb5a029b1760b4cacfdfd95c868e260245701d8cd3d2bf585c14083b79dd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075777, "uuid": "cf21fd05-e0b2-42f6-8173-8eafd61d6211", "value": "T1C2835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075777, "uuid": "3eebf1e9-c46a-4b80-8c97-9c8a30585176", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075777, "uuid": "d82db51d-35a9-4c0e-8438-c05ba24ad473", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx33k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx33k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075777, "uuid": "94ff7f7c-2b6b-4129-8ea5-130806852753", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075777, "uuid": "471cf0d3-0921-4147-88ff-74a6e86513e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075777, "uuid": "ad3c256a-555a-4818-aa83-26cf9bcc01a4", "value": "eabe51d08a64413feffc9e624ef91480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3714a208-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075606, "uuid": "1ac7925e-67c4-4843-ba67-0dd61db3d657", "comment": "Malware payload (ConnectWise)", "value": "55e70d807e50f1ef9b0cf500299fc563", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075606, "uuid": "204caaa7-62c0-4433-9962-c4c58ce4e1be", "comment": "Malware payload (ConnectWise)", "value": "030e0a0ca42c7b1d18152ad81c666958b7590d95e51a6af5b31c6d28e8ecba49", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075606, "uuid": "fdd3a725-9d45-4271-bf64-504897d612fd", "comment": "Malware payload (ConnectWise)", "value": "486bb9c91d7934f507041d206b4ad67d093b6e56", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075606, "uuid": "dedc9df3-4618-4f70-8299-58e0babc26c3", "comment": "Malware payload (ConnectWise)", "value": "91c1142d4ad880f8da4c9d6b6c571d4cb6cf72f3bbc4a98e0285f7cd561193d71f4e609da04a266331aa0afb4d9a67a7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075606, "uuid": "22e1014a-4df6-4f9a-9352-f6c1cfe25b80", "value": "T1D6836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075606, "uuid": "7a75e98e-2872-4243-864d-6e3bccde325c", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075606, "uuid": "5f24ff1a-a836-4e7a-a524-3d380f1a808a", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Xk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075606, "uuid": "bc37a2b0-6ffc-4e25-a498-a29bf7c0cf64", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075606, "uuid": "5736323d-fb70-4726-a2b9-175407cd3cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075606, "uuid": "b01041d9-8fc0-48af-a605-8bc8081bcaeb", "value": "55e70d807e50f1ef9b0cf500299fc563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cea79b4-4d9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103882, "uuid": "8f262aa0-0104-48ef-9f41-d8c56cec12dd", "comment": "Malware payload", "value": "7eff003c98c697928b47d9054028251d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103882, "uuid": "c2708c1b-82e8-44d3-a86f-441d4cd501e0", "comment": "Malware payload", "value": "0331d84e094f309014a0ebf94597f7bd452006ea9e9b1eb390809eabf4449b22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103882, "uuid": "43d3760c-3039-4ecb-80ae-ab008c04296e", "comment": "Malware payload", "value": "89668c4e0567dbb829c63d4d0184df88cbe54bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103882, "uuid": "9161f56f-6ae1-46ff-a55b-b27d906d55f2", "comment": "Malware payload", "value": "dfab8497ada8cb284c90c879a3eb933cde647d9a63c598a32e4b60d80f45e698ec8ce318b6655bd044abf3ccf8374997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103882, "uuid": "a2aa9224-16e0-43f1-aae1-8b9799cf15a0", "value": "T1D4E42303A7EC4071DD743BB060FA27931B36BDA29D78939B27909C5E1D73180A97276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103882, "uuid": "5fc61699-1aac-4415-a9e6-4cf2eded0f55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103882, "uuid": "436c9437-13f6-417f-be55-6886cbf44fb1", "value": "12288:bMrDy90XB5JFjS4jyOhbt6Pu7jhpis/itqrU+by0YZYKcZbn1DT6ohlT51:IyWpwdUisEqo+by0TZb1DTBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103882, "uuid": "8843378b-05c4-4be8-a351-a988733d6c01", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103882, "uuid": "93deee5b-f3ed-4ac9-b766-88531696d8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103882, "uuid": "39de7e1f-eae9-43ce-b436-238abda02d93", "value": "7eff003c98c697928b47d9054028251d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6d3ac0-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096577, "uuid": "1724b4da-27c7-4f52-a2c8-e6186b1133bf", "comment": "Malware payload", "value": "ea710beea7c47db63dc4bfe5635f2889", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096577, "uuid": "981c500b-9de7-43b8-b396-7e33a1566066", "comment": "Malware payload", "value": "0352598565fbafe39866f3c9b5964b613fd259ea12a8fe46410b5d119db97aba", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096577, "uuid": "ef5831c1-a472-43e2-ade2-fc8b586f425b", "comment": "Malware payload", "value": "ccc81ea6e98db71f58c447cb8048e0b8302bb9c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096577, "uuid": "a5e0bef4-461d-478c-98b2-6dfccbd87595", "comment": "Malware payload", "value": "1bf1f435b1556b384e0a63cd2293de62c0bc893a315cf8504383f1dfc0820eee690cabd2d0ce61a7afa6906a74e8a9d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096577, "uuid": "e09fb492-07ef-441b-ab5f-6f02e0f64620", "value": "T109E2F2F35FE2353E09A2039B6A0743A616315075FE36FDD2A99F90182291C59FBF2709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096577, "uuid": "6f032dac-ac9a-4496-b815-4a41e366217f", "value": "384:y5PbClX9lPyfMGx7Krin/5vPIES/LIuUWSNWchq0s0AWEQ9xuWuMroydOFlVhwzB:tXmvxPIES/nUWyWchqUZXxuWuMroIzzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096577, "uuid": "cf195f2a-c0d7-4b76-bed0-5687d2ea4515", "value": 32306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096577, "uuid": "e957e4dd-a133-430a-99b4-3e3482900773", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096577, "uuid": "f0ac71ec-c46d-489c-8c5f-305269ddf682", "value": "azluav.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0e3295-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694067969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067969, "uuid": "99f97740-a298-4e94-9728-8c2ab97a14db", "comment": "Malware payload (Formbook)", "value": "4f91d6f43a69717ff16f3c09dcd0e7e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067969, "uuid": "13c07309-a0fe-471b-b4f3-2227dc9227d4", "comment": "Malware payload (Formbook)", "value": "035c64adedb7e567711f5a793c587b5886bea69e725a5f038f2b7f01a1eebd5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067969, "uuid": "39a360a8-8706-466b-b860-354fdbdbbcf0", "comment": "Malware payload (Formbook)", "value": "51406ad0646c199764a7b2a26e2d31fed91ad77f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067969, "uuid": "d82ddfd3-792a-42c2-9b9d-8d7bd55893e5", "comment": "Malware payload (Formbook)", "value": "16e54e55eed0ddc0f50670b8165cc3522fdad0cc3a55cb81b226ce312a6b62c9529554f3dfc22b98a22e8b16172e0ae3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067969, "uuid": "40626f42-547f-4c5d-888c-e2b3b88da498", "value": "T15F2553FC5CFC1136D9A0EE908ED9851BB1C0A57FF289AC1D97E20B650252A49F88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067969, "uuid": "e167f065-2edf-4b6d-8536-13bd82f8cdcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067969, "uuid": "80d1e053-054d-42a0-bf56-154abf178fd8", "value": "12288:GPGFbjnlnvSYq7VFFKtanTtcDPHNtr0P18UEbotQ:GajlnqntLTtcLHNtrK8HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067969, "uuid": "685495ae-e7f4-4f6f-80cb-0e2769ae41ce", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067969, "uuid": "2be0a7c1-970b-4342-a914-0cf49bd008e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067969, "uuid": "548cc484-a506-44cc-bce9-30ff19d44247", "value": "4f91d6f43a69717ff16f3c09dcd0e7e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480a9179-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075635, "uuid": "aba6405b-c46c-4192-8536-5109d4c7b84e", "comment": "Malware payload (ConnectWise)", "value": "83ac2edb7087fc9e047d196c262edaca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075635, "uuid": "08420a77-f69a-4bc8-add1-88c1ec17457b", "comment": "Malware payload (ConnectWise)", "value": "03ca454c4eccefb27403bbaf61f9f53922c7ad449611f9d89e7589c9396086ad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075635, "uuid": "15c50840-a766-4769-b479-0e36b4f0102d", "comment": "Malware payload (ConnectWise)", "value": "5fa2b4effdb85364d5ec9d8fb0d16b6afc220c06", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075635, "uuid": "8cb0616a-ad87-4a54-adaa-37a820ebfd54", "comment": "Malware payload (ConnectWise)", "value": "5f08e7cc245386f34aad3343590bf397b22935507ed4edbb948057014f6771328464c0e548240d0011cd5aabff590757", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075635, "uuid": "67ce6d8a-e272-461a-b9b4-13ea93473179", "value": "T1FE836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075635, "uuid": "0497cb1b-b982-4951-b88c-8f269f1ce164", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075635, "uuid": "1b7f4552-1cb3-42b4-97ef-f95836d2aad1", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx35k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx35k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075635, "uuid": "c354b1d4-53f9-4cbb-a2f8-45cf6bae981f", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075635, "uuid": "7e41f1d5-809c-4322-a905-64b0c0df29a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075635, "uuid": "db78dba3-0992-46ba-8a69-acdd647faeca", "value": "83ac2edb7087fc9e047d196c262edaca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713dfdc6-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075704, "uuid": "4b3b2571-ef23-4b64-8255-85d38a3fc19d", "comment": "Malware payload (ConnectWise)", "value": "358772c276584c1f7658b527d1d58c0e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075704, "uuid": "11099916-ac44-4edd-93e6-4589e1da1e6c", "comment": "Malware payload (ConnectWise)", "value": "03d90ae5ecb0de3fa095fc6c43cfb137806a564615504c557e11f3341882bfbc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075704, "uuid": "0f45e2b9-26bb-4cf6-9dba-3eae6e6ba088", "comment": "Malware payload (ConnectWise)", "value": "29e75096371e7516a8bd4e33f94538193543eb18", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075704, "uuid": "4a514c1f-b64e-4c3e-ad69-9fb6bd8cf681", "comment": "Malware payload (ConnectWise)", "value": "1af3b4fd2fd50fb457c3ddc2faabac6e19b63546c499a0ee5edfe6a01fe2321c49898599bb148162d7a7b4445ce837c7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075704, "uuid": "40e7e46b-7ac9-451f-8b89-69eabade618e", "value": "T1C3836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075704, "uuid": "11c54af9-e451-473b-9a9c-deb79bda9b2b", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075704, "uuid": "2925cc67-2da7-4c3a-81ac-9244622700d1", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Kyk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075704, "uuid": "4b85e082-fbe1-410d-9026-6c0e4e6d126a", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075704, "uuid": "ca7d1dde-516d-4bba-b65f-535c5d0760d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075704, "uuid": "ea692edb-73fb-4c79-869e-5e8b6de8095e", "value": "358772c276584c1f7658b527d1d58c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74746450-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075709, "uuid": "48c4a810-d20d-48ae-b181-dda8cf765582", "comment": "Malware payload (ConnectWise)", "value": "7406022d7af00adeda38820513bbd9c2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075709, "uuid": "66fe3e50-aed3-488f-8db0-47eb8e9a22c0", "comment": "Malware payload (ConnectWise)", "value": "044c592cbcebd68573dd976cf13fdf2501dc622f955f93ed22db48210c916f76", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075709, "uuid": "8d666716-b002-48dd-a86f-40c80ea638ca", "comment": "Malware payload (ConnectWise)", "value": "bd9c2199caaa072c582e7dce9969bd17ce1b7593", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075709, "uuid": "2ac44dd0-9386-49c5-bb6f-06bbcbbb878e", "comment": "Malware payload (ConnectWise)", "value": "3d0f34560fbe4474164b09e5f31ff4d98790094296239f481085bd48c245b9548b3bb49bd4caa81f6101a7cb4f7b8dc1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075709, "uuid": "ea00728b-0a3c-4f9f-a5cd-0ab7ea0159e7", "value": "T14E836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075709, "uuid": "1e199eb6-890e-44ca-b534-70f87e1c8a90", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075709, "uuid": "b2142e17-223f-4fe3-b6d5-82b3cab0c7c5", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx36k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx36k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075709, "uuid": "37873838-aab2-4791-8084-f0dbc47b4990", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075709, "uuid": "4ee178b0-3434-4afc-9f5f-44ba51a4ed1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075709, "uuid": "f9dfc04e-f659-480d-9a32-6ba936a229b3", "value": "7406022d7af00adeda38820513bbd9c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b782ff10-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081405, "uuid": "be210441-7076-47fa-8f3f-fa9abbb5d6b9", "comment": "Malware payload", "value": "5b65e0442761c3ba7ab13f19e696a3ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081405, "uuid": "32fa2ce2-efa2-4b11-aa33-3adc380116ab", "comment": "Malware payload", "value": "044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081405, "uuid": "53932192-ff35-4ba6-92e5-2a64e6928f18", "comment": "Malware payload", "value": "840cd5fabb617cdfd848ff29253b4cce79213a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081405, "uuid": "0b7365f6-f806-4b7b-9d13-4f2c77ed2c23", "comment": "Malware payload", "value": "94732b1b366088e8a1094b63ffbe8e669751adf9ec536695ab730ff3e40656081c51576374b141112baa1d7e441de930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081405, "uuid": "b2cde7f2-14b6-4ab9-abb9-00d2442e8e82", "value": "T155345B87B2A120FAE876C23886534E55E776F4210370ABBF0764465D5F237E09D3AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081405, "uuid": "ccea79ce-288d-42b2-b1ed-3798c4cfff6d", "value": "97e0129b4b7ba82d6266f387d43fcf0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081405, "uuid": "c99346f9-f874-4f1f-a2b0-e24082794684", "value": "3072:dZvq0Fnr1gWPgOYVkN6rnhccEYMY2wuoyq8pq+8MhHRIK8k4B7KHpwRXDYNdY2vx:dZvdr1bkVkNwzEJwu1Z/L8hgpwZY79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081405, "uuid": "90870272-2bab-44e5-be41-6ca366b8ca4a", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081405, "uuid": "5de3ba96-3de5-4fc7-9e5b-96d7feddb68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081405, "uuid": "27526019-54cc-4bcf-9873-471e59bcbc22", "value": "InstallService64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26810a47-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094047, "uuid": "b53ca59a-d2ab-41a6-9f6d-8d70d1896001", "comment": "Malware payload (AgentTesla)", "value": "d51b5aa65f6e45583e937d4393ff7fe0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094047, "uuid": "37472020-2aa5-48a0-a3d9-eb5871f03457", "comment": "Malware payload (AgentTesla)", "value": "047b3ea88d541761eaf642fef56127bbe2e493f7e9eef3d93c363a8a2d542540", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094047, "uuid": "8dcd4460-2e74-4403-98b7-08e98b8d034d", "comment": "Malware payload (AgentTesla)", "value": "1df6143e16d898d6ef125ab5da86a8db2cf58fbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094047, "uuid": "9ecf1497-f0cd-4945-8090-ef3ae0b8207a", "comment": "Malware payload (AgentTesla)", "value": "ef58999258f0253fe3428b3eb30871f37e7715739371842e2fbc978eb834c9dee1574f214324a7d4257a32214a046471", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094047, "uuid": "1d79e239-010f-49ee-9e85-f80c71d08d2d", "value": "T1E934ED437E48EB11D6583D3B82EF6C2453F2A4C70673924BAF48AEA529513436D6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094047, "uuid": "1b1947ec-57f5-48de-98ad-38463d9653fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094047, "uuid": "16a7cf6a-a753-42e7-9178-8f9ca4ef7903", "value": "3072:8csBAUKbuAeHpcp73w2bowrvdN51TCvUW:KbKV2cZ3w2blFN51Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094047, "uuid": "4645e7e6-dec3-41cf-95ea-1ab50e1ed86b", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094047, "uuid": "a0c91159-d8d8-4e6a-ad4e-4ad300a2945b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094047, "uuid": "406182c0-5fa8-46ee-9d41-aac456353a8d", "value": "oo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ba1ed-4d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694048483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048483, "uuid": "cf9f3be3-f801-46e0-8640-22cce1a087ff", "comment": "Malware payload (Amadey)", "value": "a627994ff0b31010ba47b4914cdfcca6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048483, "uuid": "9f03046b-b1f3-45aa-849c-21c79340985b", "comment": "Malware payload (Amadey)", "value": "049c9ab9a3a3531d13e86ee7e687a45538955b48f62e2149e30d1206ec8c3df4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048483, "uuid": "1f814375-e693-464c-9a5c-81a39d765dbe", "comment": "Malware payload (Amadey)", "value": "f529aebfb16357bf6f32daf0a4eb0496217f94fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048483, "uuid": "93945a5f-3967-41b0-8fb8-9eb3ade0bc5e", "comment": "Malware payload (Amadey)", "value": "79bf2fe124c2b773b4fc92780627c0956a523c28738d7f4005d321668d407e8bb997fe5aebdeb19b8f9e685aa3ffcd02", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048483, "uuid": "6449ec10-4204-4577-be3f-f2f645f50572", "value": "T106052345E6CD5072C9F12BB118FB03831B39BC529DBC426B6711A98B0DB33A86972777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048483, "uuid": "39e90284-9ec0-45e1-90fc-7b465aad8ffa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048483, "uuid": "acdd1a8f-f5e5-4527-9ecd-b16411820aed", "value": "24576:TyjzarSuI0k0ObVJ8bJ2juPQ1XKeWEjMKMb8t:mjzkZjOTRnWX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694048483, "uuid": "34a15fb2-69c7-43a9-9c33-9a785a289a63", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694048483, "uuid": "33c65cf3-aafc-41e4-bf0c-44c680e09d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048483, "uuid": "230816ba-6c65-4fe3-9cd8-ec802f19898a", "value": "a627994ff0b31010ba47b4914cdfcca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969ae22b-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103254, "uuid": "f33b9d66-03c9-472a-b022-ced434c5a444", "comment": "Malware payload (AgentTesla)", "value": "67bdced33423ae5d2059470cf905ad85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103254, "uuid": "31a96365-b76f-4827-a41d-0affdc167928", "comment": "Malware payload (AgentTesla)", "value": "053c8aaa925b54a2410ff1f41f6f06bedf4f6d61067e27a8ad6cda39c91e52fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103254, "uuid": "25f5b809-bc20-40c7-9d5e-e768bf5f24e5", "comment": "Malware payload (AgentTesla)", "value": "a1af2d1200822119b536955671ce9374fc4d3dd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103254, "uuid": "f9eb0736-c8a4-44a1-a6f0-5f102bc74d82", "comment": "Malware payload (AgentTesla)", "value": "c3dad7427b0fb981e64c8bd7fa27c6b6408086a15309655d39b468e09a7053ca4dcf74bba085914907e66c7a8d1e62b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103254, "uuid": "c4fe8ab8-2fd2-4683-afeb-fddd884b6baa", "value": "T1A8E4F0F92429D7E2D7B453FF516B98719963BC41653087CC3BBC3A884EA5AC31922C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103254, "uuid": "6c7462bd-0517-44bb-9f76-f1644b56d96e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103254, "uuid": "152d1d03-e999-44bc-8b19-5ffc6df6d5ac", "value": "12288:s5fVsbR2Rx1fQGGZsT54inqfBYg4Bmr7rHVgPnMPfgT0OaRcHT:stO2z1flKsT5vIBH4BEHVgPnwIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103254, "uuid": "a80e53b0-10ef-491c-acf5-8cd2b1d0558a", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103254, "uuid": "8f6fe5ff-d479-40d7-9843-f5e78ac21575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103254, "uuid": "0f69ea28-2bee-4413-988c-81748d01bf6f", "value": "DEKONT_167726553667652,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b31117-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075659, "uuid": "daf124cb-dd2a-47f4-9abc-f358ca9e8bf0", "comment": "Malware payload (ConnectWise)", "value": "600b6a86405518a3f9e39774b3912cce", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075659, "uuid": "79f8cb8c-b714-4bd9-819e-dd0c4578c627", "comment": "Malware payload (ConnectWise)", "value": "0593094d03c80abceea57329b1a43c95e4a1c7854e300a89f78041c6d9444b51", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075659, "uuid": "ae514471-1999-466d-923a-03f416d7c945", "comment": "Malware payload (ConnectWise)", "value": "c99f4690e7b8f80c1ee70fe4a8170ac35567b5b6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075659, "uuid": "0b1df17e-319a-49be-b392-5b9880f31a5e", "comment": "Malware payload (ConnectWise)", "value": "26adf0fe12f4e1067584a9ebd21266448108cd9f2b009e22013517a8987af521268e76fe716f6d4f315818c5b1b4ef12", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075659, "uuid": "87d92b53-7d70-46fd-97de-3471472bcfa9", "value": "T1D5835B13B5D18475E8720E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075659, "uuid": "5fdb828f-9058-4c1d-ad51-000ec6db463c", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075659, "uuid": "e9065788-668a-4ee0-b37f-434b9eb925e8", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Dk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075659, "uuid": "aad9f4af-22fe-48e7-ab8e-a8af38d9d4a2", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075659, "uuid": "3cb34ea7-5b55-4ee0-8cb4-3a18d35b2a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075659, "uuid": "53d0cf2c-faac-4321-b6d5-4c19f432db45", "value": "600b6a86405518a3f9e39774b3912cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c34576-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069195, "uuid": "e14dc2ea-9f11-4b78-b52d-68effc225c22", "comment": "Malware payload (AgentTesla)", "value": "8e8004de1eb1d2cfff7b50a18d3b198a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069195, "uuid": "a0b6f57c-4024-491c-bb35-7ec9a0d82f8f", "comment": "Malware payload (AgentTesla)", "value": "06cb053167d7f31dd75b31704efb8594d482ed781cb7caa4a2ceb100dc98362b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069195, "uuid": "aa9c12c9-2f3e-4ffc-aa8b-ca301f21b2ac", "comment": "Malware payload (AgentTesla)", "value": "1d04fec9817eabd00f4ac43370a7cf0fbde36981", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069195, "uuid": "fdf886f8-1094-4822-8196-6afa2649026e", "comment": "Malware payload (AgentTesla)", "value": "1b5670bdb6a33e7496998814d29af27ca26bb60c001ae1c6b82bd34565546a6352c567ef11e442b17dc39fc2a26d436f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069195, "uuid": "211fd806-d2e9-4e29-adef-072ce4a56d80", "value": "T121249A74A1F12ACDE896CEB28E60EA19FFE71C558A45420FD13239F6553BB85C6040FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069195, "uuid": "40dde82d-5cf8-4033-aa89-22477a9cca78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069195, "uuid": "5ce1f3c2-ec4d-47dd-9d3b-b5205a49a0eb", "value": "3072:lElL3JVg62SBK8ukCEb71hEbaFSkjiRrPq:+V5+MK8ukCE6a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069195, "uuid": "a6a1abd3-c029-4a48-9eae-1ed71bca70c2", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069195, "uuid": "6e7c8ff7-2bf5-4430-99f4-72e7fb96086c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069195, "uuid": "181337d3-b3e0-4706-9be8-092a33d70e7c", "value": "Fiyat teklifi Istegi_230906_PER 1000 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed3e012-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1694103295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103295, "uuid": "483fae7b-314b-4a78-b1f2-88156ee752df", "comment": "Malware payload (STRRAT)", "value": "eccbb3a6dfbc46c5251ab1165d5c317e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103295, "uuid": "bebe51f5-21d3-42f6-a202-1327389594dd", "comment": "Malware payload (STRRAT)", "value": "07b688355c7f386c1dcf4f70fac7a4ccec3f89c5415afce2bbfcc68a1a27f61c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103295, "uuid": "86c95ba3-9af7-48aa-97f2-3be14f928aee", "comment": "Malware payload (STRRAT)", "value": "e6979b6b569b2efe8314e87f551a873118d42e5e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103295, "uuid": "e2aacb8e-5f75-42bd-9fef-443d53b7baa1", "comment": "Malware payload (STRRAT)", "value": "d5cc9b0cbee52cbc23911488f534fedfbedd95f62371c4491fbcc9e649b66ba617bb087df0571703347abfcb0132ee9b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103295, "uuid": "6de5710a-4d19-4352-bed2-0f05fedc558f", "value": "T1962401076DDEDCF5E15758322125C1326A8D446DE08AE2372DFD29884D74EB90F12ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103295, "uuid": "22536fc1-81c0-4567-8d08-8b5a39159735", "value": "6144:OAMjYa8v0LSNxoeIhLs9+jHnR2uXwXBSpaN3:1er83x7IhLsgjHR22wXBSA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103295, "uuid": "f7e26883-39a9-4664-bbc4-24406fd096b1", "value": 223906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103295, "uuid": "1953adc2-fa6b-4cce-b674-125b6cc268e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103295, "uuid": "35c85b3d-29cb-4dd3-9030-ff63e2e93cc2", "value": "PAYMENT RECEIPT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ccd716-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111621, "uuid": "c01c5274-7ff7-4073-aa78-5c92111faed9", "comment": "Malware payload (BumbleBee)", "value": "95138e2d1e51d45f653eef0823ad3c89", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111621, "uuid": "ac2014eb-80ee-4c8e-8051-de04f578b5b5", "comment": "Malware payload (BumbleBee)", "value": "07e625d9acc7803be901c9b5cfbad7265c9ba0f5d617109584a77a32d8d153f2", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111621, "uuid": "c5c3e904-4c2e-467f-ae01-e749378ac029", "comment": "Malware payload (BumbleBee)", "value": "a28285ea359d00e3d6769481e5db882807cd7796", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111621, "uuid": "44badd81-d9ae-4220-9684-ed40e38bc604", "comment": "Malware payload (BumbleBee)", "value": "797c55146cf8522252924319ec2a3ce021bfcabdc5a02cf2d45f6c3b33c744c603e909e84baa12905a3939776f6dc819", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111621, "uuid": "dbbfbea6-a14a-41f2-86ac-49fdbe86bfa6", "value": "T142D4C04FDDE1FFEAC42D51B6C88F02AD16A3A6406E06097B6569024832E3B1373E775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111621, "uuid": "b22adced-fd0a-4035-becf-10348d5fd6f0", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111621, "uuid": "cfe183e3-d12f-4ca8-bc40-0415d29a0dfe", "value": "12288:DSHXS6dIkIYpPVpPE9NSn8V+Nu8Hx60PinBYqT:DS3Ik7P808QrU0PCe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111621, "uuid": "7880fb85-d50f-4955-ac39-00d6315c284f", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111621, "uuid": "54e348eb-acf2-4139-ab03-a6cf2650117f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111621, "uuid": "f84615eb-5d3a-4046-bd31-16b9b9d132f9", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da591f3-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075698, "uuid": "0fd73eac-8693-492e-bb89-dfa2d7ba1975", "comment": "Malware payload (ConnectWise)", "value": "144514bd834f65bb76e80e412ca046f9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075698, "uuid": "9da88a77-a3cf-4d43-beb2-419a801b980f", "comment": "Malware payload (ConnectWise)", "value": "07f656c201d2495d6c0240ec2f6362ebde7eeb4ce4ec0f82f370980fdc539a9e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075698, "uuid": "35b4bee2-12f3-4967-b1e3-4f7a445bb0a2", "comment": "Malware payload (ConnectWise)", "value": "e10e4441ddc6cebbc383652e127d384f1a0b2855", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075698, "uuid": "55914d3f-59ea-4ac5-910b-994b66d14f74", "comment": "Malware payload (ConnectWise)", "value": "cd9459266b8691f389d7045484b2982d86eb36e39dfc7eccee1405ed2e985022dfc046d0470a0ef26ac80043c0988617", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075698, "uuid": "5bdf8c9a-2d41-43e1-b2ae-10c03e710ce0", "value": "T175836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075698, "uuid": "9ba63047-67a0-48d9-902b-045fdb392230", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075698, "uuid": "0be4750e-b9ab-423b-96ec-492d950808c5", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx38k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx38k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075698, "uuid": "98b3460c-84ea-4a40-885d-e27b04577867", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075698, "uuid": "f2495591-de8f-429b-848b-3dc853448ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075698, "uuid": "215a0fd8-9d5d-455c-a225-85bdb86dc168", "value": "144514bd834f65bb76e80e412ca046f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca785d6d-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694092604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092604, "uuid": "6f5e06fd-de98-42dd-aa33-7f87a3976434", "comment": "Malware payload (DarkCloud)", "value": "a785122ecc68b1abf003d3ea6f5bf273", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092604, "uuid": "029cc17b-a78e-49cb-9825-758f2b9e19cf", "comment": "Malware payload (DarkCloud)", "value": "07fa7f637ba44f3af4c56c47bd23cb0a6e0dbb5f3544fb39affcfb08794e75cd", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092604, "uuid": "d6edbd91-eea5-4254-9624-0c6a2f85d778", "comment": "Malware payload (DarkCloud)", "value": "94557d56efa95213cc4bf687626a64ca29b6f5ff", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092604, "uuid": "f2c65a51-aa28-4733-a81e-1293415b3b49", "comment": "Malware payload (DarkCloud)", "value": "3fd4b9704c1db68713f8b6764fa6a54c13b3357643860fdb30a18b5e11453cda926c829b6909a4f754685e1299d45d89", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092604, "uuid": "be143fc4-9839-4374-8d2b-be498c9d35d3", "value": "T194A42A1BE711A02EF192C5B0EAD452A768152EB72298EC57FB816F4832355D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092604, "uuid": "982d82f8-d72c-4bc1-912e-1b5b45ff00ea", "value": "e1f594e59f684b51e1a504fb3c3b8636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092604, "uuid": "7f8e60e9-29f6-4904-8919-20025df43866", "value": "12288:J2tFZW4yzH9utcgyWDXZIuzLMAxU3hPsjYKkJj6GmZU:+2HOGuvMAWMYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092604, "uuid": "e5945f21-22a0-4728-a570-bb015f2371e6", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092604, "uuid": "a031ebd4-4f4f-4104-a5f3-cf1f6efe511b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092604, "uuid": "49a406d5-ab6f-4d69-8afd-d0653f79b8d7", "value": "07fa7f637ba44f3af4c56c47bd23cb0a6e0dbb5f3544fb39affcfb08794e75cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7176d3-4d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094513, "uuid": "fee36fd1-3d7d-49f6-af1c-50669b567f1b", "comment": "Malware payload (AgentTesla)", "value": "ebb4d63801e26fad3d850e7c3d443e77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094513, "uuid": "cd3635a7-ccdd-457c-8339-8ebc8b9e395d", "comment": "Malware payload (AgentTesla)", "value": "083672f38f6c31524367d15712e1983959c8f27291a60437f717bc2f80b06b63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094513, "uuid": "66d0814e-e1d8-4934-adc6-319326ae3c22", "comment": "Malware payload (AgentTesla)", "value": "28d798a21111baff0d69745910a56cc36bb887f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094513, "uuid": "a14507c6-aade-44a9-ad86-6e31294aba0e", "comment": "Malware payload (AgentTesla)", "value": "87fb4b771c88c09b4e3f792a163bcd5aeff048c93cbf20f8d66a680264ab782de2ea9b9846893516f4c660ff3b94869a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094513, "uuid": "c39614c7-42fb-4d83-96b0-e9e5764559d2", "value": "T19F25ADC0E446AA90EE659F36D136C938232B7EA9E530D50C19EF3D333BFE2921454766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094513, "uuid": "ca516bc4-b79d-4e6b-8a71-80f1f5a2ccfb", "value": "24576:GZBTDR7hR4vT09pscZZaIT+5jXWLcM1qU:SRDRsop+fdXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094513, "uuid": "06855950-ad92-47c8-b8b5-d8a5649471a4", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094513, "uuid": "9ceb56ff-365c-4207-a8bb-a0857f7793a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094513, "uuid": "42c02493-0926-4119-8295-4da3011e15a8", "value": "083672f38f6c31524367d15712e1983959c8f27291a60437f717bc2f80b06b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80c9321-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694103794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103794, "uuid": "3ea48259-15c9-48a5-8171-550e790660bf", "comment": "Malware payload (RedLineStealer)", "value": "ec1daa24dffab883d55bc9257eef9fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103794, "uuid": "7d3730b4-ff69-4068-b652-70915d5a8678", "comment": "Malware payload (RedLineStealer)", "value": "084b41ac048545f0787470d4026243539ffbacc28543776ef091df255d6567fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103794, "uuid": "7b2d6f18-91aa-4fa0-aa4d-b9fe73e7a6b3", "comment": "Malware payload (RedLineStealer)", "value": "429ee633a0ce4f43fc8d7f4dd734afff36bf5a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103794, "uuid": "a7aa6d31-dda0-477f-b1eb-3570ca80c09f", "comment": "Malware payload (RedLineStealer)", "value": "3a45be8f80b2a3451095a001e5e743deb0982792cb76c5cbd3bc5e212bfa8a51d5daa13a0da990dba565a6138309fe85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103794, "uuid": "cc0692ff-a7b3-4d53-90bc-a34c8cf5f122", "value": "T1F1052243B6DC8122E9B817F048F743930E397CE16D78C3AB2745692A9DB36987532727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103794, "uuid": "0f1bdf15-3447-4739-b5be-077987e1ebfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103794, "uuid": "cad9c3ca-379b-462a-afcf-13d2dc4c4e96", "value": "24576:hyhNndtZAV5jMzbN2iHqX3q8gcwAymMC:UR7ajsdHa3jwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103794, "uuid": "3447d659-660d-46b7-9f0c-83486bb7f0eb", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103794, "uuid": "54454251-b574-458d-aa5d-98c292454c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103794, "uuid": "af4666c3-b164-4519-8d71-44f9b72446f0", "value": "ec1daa24dffab883d55bc9257eef9fab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3904e064-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069167, "uuid": "d0f548f4-6742-4d35-b55b-3e1685f59b09", "comment": "Malware payload (AgentTesla)", "value": "aa45f48c5edb80fb3f8f689cb5cd2ac6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069167, "uuid": "d056a597-8e60-4c39-a64f-35be6c34d991", "comment": "Malware payload (AgentTesla)", "value": "08892ca888c99399cdb89a8d77bb0154b6f0443b499a73d5a4d08dd2886b9ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069167, "uuid": "b43bc0da-ee03-4296-a86b-48aef2a14792", "comment": "Malware payload (AgentTesla)", "value": "dfe5c1b624a38b38a545464953cf2434a24b3fb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069167, "uuid": "d4425f01-e862-4c0d-97c0-6cbe4c75a876", "comment": "Malware payload (AgentTesla)", "value": "10766a34523b566dc5f6b145a03a98b079a2dfba8e3709a0ccb12e69dbd6517d839762d52868335075e97478d809af88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069167, "uuid": "157940f9-46d6-4784-95be-5b46ed0eda53", "value": "T1AB248446F68492A9CC18A3B07932CA7407167EABED74645E5ADD3E273FB74F20076843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069167, "uuid": "663473a7-e8fc-4e76-b4de-5aed3ca4ca6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069167, "uuid": "4bfc5fab-7057-465e-9f4a-b669aead5595", "value": "3072:+Dt8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:+DOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069167, "uuid": "b15808df-afdd-409f-a1c7-99826b6d4338", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069167, "uuid": "6b67cdbe-d46f-4e67-b42d-2661ff2c535e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069167, "uuid": "4dccca01-4879-41c3-8bdc-d774d61ae1c3", "value": "E-DEKONT1,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0ddb62-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694083022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083022, "uuid": "8de32933-915a-4cbc-afdc-1934dfd7aa17", "comment": "Malware payload", "value": "7e25a8e1b1d81bb7052955fbbbdef3b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083022, "uuid": "a6c0d02f-3dec-4b8e-8137-1436ab9689fb", "comment": "Malware payload", "value": "08d3d3ac2d0f381ce5cacda980b8d0f72161d4beabd83839ee9c17c7279b3295", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083022, "uuid": "ebdb4356-211c-4cb5-957f-9428e9877138", "comment": "Malware payload", "value": "ee4caf55308d27d963dcbb03e0d9ef209425228e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083022, "uuid": "d6bd2e3b-1b59-4e62-afee-ad06d18b1343", "comment": "Malware payload", "value": "01590767dc70f45205f1fdfd53eac88a152c5f644eaeb513b2f8514ce8ba9e2e916a288111008ea82af826e0ba9b0727", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083022, "uuid": "71408c7b-c4b4-424c-88f5-5cc6452a7e15", "value": "T14EC140A6E7F0B4002A7B9BE3B51AEAE4FC6C55AC7AA14E4DD141FFB4BC504108583E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083022, "uuid": "22aa2387-05a6-47db-ba48-2eca829ee69c", "value": "96:222kwOIJJDo3hw39InFrUnK4dKN/EbIhMmA9qew2rPziMg5ZW9:222n5eTFrUn1c/EbIhm9qew0ze/W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083022, "uuid": "9188348e-47ca-4ae2-824b-dcc3e7c238f8", "value": 5695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083022, "uuid": "a6efaa11-2e8c-4e79-8f47-28d05b48ba53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083022, "uuid": "d88ddadc-309f-4245-b7eb-8793c2c6a386", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936ee76d-4d67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694081774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081774, "uuid": "093d6094-428d-451b-913d-1c2aef80f18d", "comment": "Malware payload (Smoke Loader)", "value": "f4f804dc485c150c7c1919c6750517ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081774, "uuid": "253a7c7a-d5cf-4906-9608-2eab8afcf003", "comment": "Malware payload (Smoke Loader)", "value": "096e661b2f55e5fef5846835bff804d60bed1987ab98a89e3559f75bb3802298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081774, "uuid": "cdb03e75-da08-4d12-a387-66729994020f", "comment": "Malware payload (Smoke Loader)", "value": "db9e592018169447959a54fb06d4d4518bb2531a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081774, "uuid": "d2c56885-9256-4312-9471-bdb4e7a080df", "comment": "Malware payload (Smoke Loader)", "value": "b57ab31eeac5aebf5559fa27b80e6613f8ca40c6f25fb00cd47572673b220c6f50af05acb00638268636a012de7962ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081774, "uuid": "44991133-4f1e-4bf6-a37f-6ea8de755097", "value": "T14F74BE769F8FABBBC12F0B359051293463F0C0D14416E7AC1CD9A0F85EEABC58B1256B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081774, "uuid": "2d8d9c8a-23b3-4954-85bc-2c495a05c145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081774, "uuid": "13eb6c8b-0988-4349-b5b3-68ec1ab689b2", "value": "6144:Gsnw5ql3BfmCZ/X0+IOpBkPmYymVWGhP4ChW0ZxGYcBw:Gmw5B0X06BkPmzmVWmP6wxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081774, "uuid": "ab55b3c5-626d-46b6-a55f-e465a09ea1a5", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081774, "uuid": "95c7293f-f4d7-4dc6-861d-9f51b44441b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081774, "uuid": "632a5fae-4ac3-4271-803d-4ce177c20a58", "value": "096e661b2f55e5fef5846835bff804d60bed1987ab98a89e3559f75bb3802298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9691e3bc-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694107979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107979, "uuid": "dfe286a9-2665-4319-80af-e43712e9522a", "comment": "Malware payload", "value": "9cda2775b084dfe759f7ef0ff5f10fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107979, "uuid": "0d4acc22-dc57-41ab-b680-bbfa8bd79ee3", "comment": "Malware payload", "value": "09adb2a2fdc833ab8523e430d6bc1c07248d74fff96780a63dc2f13eb9587b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107979, "uuid": "f008cf8c-556d-4290-acf4-2984e4523451", "comment": "Malware payload", "value": "2708953f32928d622562c2b38238f0fef600671c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107979, "uuid": "c4f1fe63-1a72-4999-8c89-3840feb6efd3", "comment": "Malware payload", "value": "a1ef086a4dd2835e79d17b320240e31a783874f0978be08fe021d9816c4e4922472404b533a142f9b23382ff13daca3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107979, "uuid": "5f9e5a09-ddcc-4626-a6b4-6a5d54636718", "value": "T11316187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107979, "uuid": "9d0d9f1d-9c2f-4518-b8b8-784d6f0327fe", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107979, "uuid": "e2b20ac6-a367-4a62-bb6a-4c8d065bf887", "value": "49152:/gh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWujXNO:Da71fuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694107979, "uuid": "65b808ae-24f4-4807-870e-3edc9dd9c563", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694107979, "uuid": "62565079-986b-4d03-9ac7-ddffdf30a474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107979, "uuid": "d14fb1bd-930a-4de2-95e5-c002940e5c23", "value": "SecuriteInfo.com.Trojan.Packed2.45650.25122.25428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd6e2f-4d6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084458, "uuid": "466d104d-3959-428b-b3d8-557b02adbb29", "comment": "Malware payload", "value": "50c0f3077ad63727797bd1d30589984d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084458, "uuid": "e6bde52b-144b-438a-951d-58076888d5a8", "comment": "Malware payload", "value": "09f2f7c0d22c2d4469073f79903b4f6d3ef1fdcf9133b4eee24a2e7ada8c7aaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084458, "uuid": "2a9a5e4c-c403-4f22-9ae7-e19c5eddc982", "comment": "Malware payload", "value": "0f8ce723760f59ec07696980d8bbc6130190e255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084458, "uuid": "210dace8-8cdd-491a-af2b-21046772dad5", "comment": "Malware payload", "value": "4ae029557ff718c59c5b4b4e300454c9518cc8d259ec70c65008ddca2da5efef25a12ce735f3328b18dea538eb3c97dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084458, "uuid": "9f5bff99-276f-4818-846f-a93a2de791e0", "value": "T11B4104054F514C30C373107001C4F1704374FF001111C74770C3C5051C1004D1731D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084458, "uuid": "b0465066-e325-494f-83d7-426fbba40ece", "value": "3:H3SDltQ11r/c111111111111111111111111111111111111111111111111111v:HiDXA/cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084458, "uuid": "7d036523-8608-4b5d-993d-982421567a61", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084458, "uuid": "77c8ece4-e18d-4fa6-b54e-5fbb383d6f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084458, "uuid": "a94df83c-9d0e-4281-8fbb-1a1c66d78236", "value": "4on.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b434b511-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694092566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092566, "uuid": "e487b574-723e-4323-a565-7b5d7b4d0ae4", "comment": "Malware payload (DarkCloud)", "value": "c73b09bc6aad55557db6e4f4becad710", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092566, "uuid": "0c52118f-44b1-453a-9df1-b384ea50f2ea", "comment": "Malware payload (DarkCloud)", "value": "0b2991fd00a7bcf6cd33c4c0dd9111fb13b0c6116f9e53527c14f485850ccedb", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092566, "uuid": "e7536d28-3cac-4c7b-9061-c615243b3f0f", "comment": "Malware payload (DarkCloud)", "value": "07abb315520fd8c2c154e70def80a366005daff5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092566, "uuid": "13af9f05-ef5d-4846-9b17-6934a087d8a4", "comment": "Malware payload (DarkCloud)", "value": "c0bb467d5cce89e74ea9fe1f549bfc7fb5743330788c096d7b6d362e3ece08fc455da17f62bef4996b1164df6bd82268", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092566, "uuid": "c06cad0b-e8d5-480a-8b81-5d3881c7570b", "value": "T17BA42A1BE711A02EF192C5B0EAD452A768152EB72298EC57FB816F4832355D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092566, "uuid": "c88a7316-a0dc-4fa3-8ac1-35ef18712a09", "value": "e1f594e59f684b51e1a504fb3c3b8636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092566, "uuid": "e25fefa5-b03c-4c4a-b5ec-7985eb9b7d6b", "value": "12288:62tFZW4yzH9utcgyWDXZIuzLMAxU3hPsjYKkJj6GmZU:b2HOGuvMAWMYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092566, "uuid": "75754441-2621-427f-b165-0204ec2a1223", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092566, "uuid": "3af361db-a13a-4497-8fe6-99424d742ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092566, "uuid": "534f8449-ca8f-46b9-a58f-7d1aa1168d73", "value": "0b2991fd00a7bcf6cd33c4c0dd9111fb13b0c6116f9e53527c14f485850ccedb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b6315b-4d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694082392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082392, "uuid": "7f6acb6c-9fdd-4bd7-be99-929735fdf9f0", "comment": "Malware payload (Amadey)", "value": "4448f677a5a1c02096a8ec1be8e4c141", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082392, "uuid": "da123d2e-f92d-4e9f-8aed-2abc76a75ee7", "comment": "Malware payload (Amadey)", "value": "0b7079cc4350194bbdecc20c1ee4f31bcd75b83adef13b44b9553caca78c49d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082392, "uuid": "ace7c102-699f-488d-8f7d-4617e5f04ab5", "comment": "Malware payload (Amadey)", "value": "ed4d718cb007b9da871b9403f22848e0a80c10a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082392, "uuid": "6e981fdd-0501-4662-adfc-7b687b1687ff", "comment": "Malware payload (Amadey)", "value": "59269de53bb4d540c821e0df2e74b85817af88d655be0525d7c4de2525871c603c10f01fed42460f4f6eede0d80dcd4e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082392, "uuid": "b43719b1-ffc8-4c8d-8957-e865520ca757", "value": "T166052252FAD9B173D8B407B05CF20B271A363CA29E7482BA2306954E1CB17C5B5B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082392, "uuid": "abed5068-59dd-499b-bf6c-889425587744", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082392, "uuid": "2dd2d90d-ff04-4a5e-99d5-98f509d8bc8b", "value": "12288:cMrLy90rwiQn3MPkz5dTHQLAw/b+lZEhHPkNKtgLjoH5tVmpGtIVhQSSTvqO1pE8:fynX3MsVpHQ0wj+++atvYPSTCODB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082392, "uuid": "7de23159-f2d3-47b5-994b-ea2a76fbacac", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082392, "uuid": "dbf33d76-79c8-46f7-8eec-99627e2ea6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082392, "uuid": "edd642c1-b87a-43de-819a-e6de1a0b6899", "value": "4448f677a5a1c02096a8ec1be8e4c141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314183a6-4d6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694084186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084186, "uuid": "d58893a4-1bed-4c88-9362-914f593936d2", "comment": "Malware payload (AgentTesla)", "value": "6134ab0c0af87b7e206ecc7922fd05ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084186, "uuid": "10387696-be64-436c-9f70-42afc8ce9405", "comment": "Malware payload (AgentTesla)", "value": "0bb5fde2b1fe8902c7bdec963a1981a16908aff051806247177c75a1168970d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084186, "uuid": "37a768a8-1e07-466d-aa5f-91c1323170e8", "comment": "Malware payload (AgentTesla)", "value": "313be6b07a55a527c047cdce868ea6e053c0a8cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084186, "uuid": "af0d28e2-aca8-4f46-8912-b17a24368bb1", "comment": "Malware payload (AgentTesla)", "value": "911c1d4f49f11aaecb167218f86a4d6eb8dd64cee5ba9d3330b6d5e71eda762f939f41d6eda88fc4ae6aab79511298f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084186, "uuid": "00ac47e7-fb74-4428-a624-90de8a25903b", "value": "T135C4024DA6AAEB9AC1BF83FEC523205803E795469377E24B0FC924AD2F45FD08554B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084186, "uuid": "e443c14b-e0d4-41f4-bf67-bae73bb9f091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084186, "uuid": "a17c39a4-26b6-459e-a1f1-4da4d7ee285b", "value": "12288:1w1txWA5Btlj8WLmeDPvpqS/2PisliuoH1u6aNy30daEVzqMi:SxWeljbmeDPvpqY2PPlw5abzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084186, "uuid": "88fea4a4-214c-4429-8306-a9c6db9db406", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084186, "uuid": "5bfc1ee1-d7d4-40b0-bad9-bec98c8bc125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084186, "uuid": "4ae1f4ba-c211-421e-8c6c-77b63827536b", "value": "0bb5fde2b1fe8902c7bdec963a1981a16908aff051806247177c75a1168970d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248e2d0f-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694084595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084595, "uuid": "9bccee52-5806-4815-8c06-906eb0197d23", "comment": "Malware payload (RedLineStealer)", "value": "4b955b21489e692c29fcfc0d9fe47e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084595, "uuid": "859a052b-59d9-4f6f-98ad-262f8a023c41", "comment": "Malware payload (RedLineStealer)", "value": "0bf0e6eaaf25db8d46a71087572a9654c00396963e1b82d1ff7f2892a6aa02e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084595, "uuid": "229f9e24-a531-4c32-b2df-2e541ff88d25", "comment": "Malware payload (RedLineStealer)", "value": "99c68933e936fafc4c92039bcaaf4bf773d9e9bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084595, "uuid": "f5facb6a-fa0c-43e0-a828-bffc8abedc9a", "comment": "Malware payload (RedLineStealer)", "value": "1b687867d74f6cc1893c5f20704e9e143c001ff118329a61147d74b07704a8afeb31745257ac803db9e5b34255eedef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084595, "uuid": "c770e48e-290b-40e9-9970-17fdf288905e", "value": "T17B04C558364BA97EC86F487E9C600CD4777CAC631246A707998EF0E83A3B7819F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084595, "uuid": "97d23a34-8aa1-489a-92af-0f929dcf1a48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084595, "uuid": "efcb6902-5251-47c0-a3e8-f191cefbf860", "value": "3072:1fvQpQcTI0OAbvyO70RJy7oAE0CA9JlOJd8e8hy:1fvqTI0OAbvWAE0flOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084595, "uuid": "bd8ac5ff-2112-4c0e-bd9a-028c6242ab7e", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084595, "uuid": "4c2b503f-39f4-449d-a5c2-29205553131e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084595, "uuid": "7a0ff10a-f9ba-4d72-8c2e-1f267b71caa5", "value": "0bf0e6eaaf25db8d46a71087572a9654c00396963e1b82d1ff7f2892a6aa02e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b2a5f0-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694090723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090723, "uuid": "4a00af08-19f3-49b3-adb8-4380ba3d06ed", "comment": "Malware payload (Amadey)", "value": "0cc2c55e86aaec431e894aa5c6f462d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090723, "uuid": "914a3708-fc38-4829-acbb-de40a97e516f", "comment": "Malware payload (Amadey)", "value": "0c010bd18585a7605315e388d88e42964971c6704e7d4c7f6baf839294be63bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090723, "uuid": "7d354b03-6055-42a8-885e-610fd68b1349", "comment": "Malware payload (Amadey)", "value": "6741e1cbd6fbd9ab316ccf38476a38837de94cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090723, "uuid": "46801cb5-810c-4572-ac5e-374cbb3bcafd", "comment": "Malware payload (Amadey)", "value": "ce909739ea6d4e9b36071f98d11d6846aad64547b30757cc3f3689a86bb898e895c614f0a567133f495058efb5efff7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090723, "uuid": "651b5e20-1e6f-42c0-8f4c-277ac91f6b5b", "value": "T1F624F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090723, "uuid": "a9c86757-983d-49b9-be29-c98e6c6add72", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090723, "uuid": "bd4dc84f-283d-4775-84ab-4b4976ddce93", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090723, "uuid": "311d8752-624d-4d8f-8729-960235da3a0a", "value": 226216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090723, "uuid": "32dc4685-b50a-4b99-93bc-04dfcd98631c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090723, "uuid": "fb866960-fde2-452e-81e7-021e421fe3fd", "value": "0cc2c55e86aaec431e894aa5c6f462d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32715be-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122173, "uuid": "1bfcebf1-1007-4fc0-9d09-e9ad22122bec", "comment": "Malware payload (Mirai)", "value": "b003e4360aae91782c108a135953729a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122173, "uuid": "82aa80d0-f8ac-4586-8426-9a6ed4afdd13", "comment": "Malware payload (Mirai)", "value": "0c70870a465e2785c377a9f28e7ea4b20fe85b8b6b60b2e3f47a44e2dc2b1d98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122173, "uuid": "46bbd529-57ab-4129-8038-f22f86bf7d83", "comment": "Malware payload (Mirai)", "value": "59b83d36c6d99ff644de231bf9049383c70ea4d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122173, "uuid": "b9489e52-a930-4c8d-ad44-0476d02cf531", "comment": "Malware payload (Mirai)", "value": "24750b970129ebe3539ade0bb37011c1c35fe40cecb21bc1502174a894ef2cdeabc68c80a327ec11d5a95c4b0c27e12f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122173, "uuid": "7fbb82cd-e37f-4311-9cbc-7c79470cab70", "value": "T18B536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122173, "uuid": "4053b3e9-e14f-40cc-9776-17b914fb13a9", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8C:N1TjJ8EVGOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122173, "uuid": "7438d4e0-ada6-4980-bc34-de16d9b5bd6d", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122173, "uuid": "0944efae-4198-4cb5-9cae-f6a10ab6caaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122173, "uuid": "ded63a82-6325-4afa-81e9-e2687c0f1dcf", "value": "b003e4360aae91782c108a135953729a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ec7069-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075331, "uuid": "1f23ca8a-f067-44db-9184-61d518377281", "comment": "Malware payload (ConnectWise)", "value": "2164b2144a19fe02c760c6be66bf0c96", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075331, "uuid": "f226888b-bf2d-410a-bcf5-4e7f073a6686", "comment": "Malware payload (ConnectWise)", "value": "0cccf28998cff9c5045bb8bada430762e9228ba3d753408b1e2528596baca2e5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075331, "uuid": "5402adc0-e364-47fa-8138-86c730307d39", "comment": "Malware payload (ConnectWise)", "value": "b59982d4ee34cde29f97345adc160ca550b6eb9a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075331, "uuid": "3071559e-4629-48ae-82c5-211ac3db6ec6", "comment": "Malware payload (ConnectWise)", "value": "cda11e3a7319f6d188579bb1505e9a07bc2bb8f240b06b7d89f66720988318eb6a4c94733703638d2236c2ea736b82d8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075331, "uuid": "dc30b100-176d-4c99-9b1f-db6be9de1cd5", "value": "T17A85F03136E4C039E2B21A39E93A92F15979BC20DA63C55F43A47D1E3971E8096B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075331, "uuid": "86e0fed0-b2c2-400e-a321-2725306e24e4", "value": "24576:ENGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhbMUUGGHpYLgmdF8gu7ura:6eyqkXSPkYYb1rSuRlUBXGHpYLgSL1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075331, "uuid": "d946e2a7-30bd-48a1-bc28-57c877a2a627", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075331, "uuid": "3c4c257e-5d29-4b07-b157-2eaab2b048a8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075331, "uuid": "13614391-33b1-4963-9afa-3447c4747d67", "value": "2164b2144a19fe02c760c6be66bf0c96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddd6f6e-4d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694089496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089496, "uuid": "eb391af0-a5aa-4214-8a7f-390f58394131", "comment": "Malware payload (CoinMiner)", "value": "ccf0276055f7e3d3b698800d1368c06e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089496, "uuid": "895aed42-ecaf-4a97-8da6-04ee1d0f1407", "comment": "Malware payload (CoinMiner)", "value": "0cdf9c8e5c5425c8250c979a2455ea03e3266e779d784a1cfeeb6f838d363367", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089496, "uuid": "675a6c0c-8f05-45a9-8fb2-ab18efd4ccd4", "comment": "Malware payload (CoinMiner)", "value": "8b187ec945d4d1cf697d024acd267d1b7adff691", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089496, "uuid": "f8ffb5f0-a97e-4d61-8315-8eaa9e7e082f", "comment": "Malware payload (CoinMiner)", "value": "53e2ca0405941e98dffa2a055612f1b4d6f01a5b93d5aedc3e6707b051c49e8db95e839d0d18b6f54eedee0b7174070b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089496, "uuid": "8a571b28-e362-43ee-8f24-f6b716b656ff", "value": "T10C44BF22B6D0A472F5230A318E65C7B46B7FB8704F662ADB1794DA3F0E702E2C675315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089496, "uuid": "9cb0c34d-c2e3-4320-9277-6ada77a765f2", "value": "cd15bb611bb3ebae60e57a6dafe0eab3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089496, "uuid": "bb397cb4-ccfb-41df-9807-b8b3080bc5b4", "value": "3072:HHZFzp6e2KQxymI1n3Uh18VMEAqsKKblaWp8IyOAjVx2Y2WeWEkMte4aW0I:bAe2JymIp0+6E4BgWB4BN2WeWEGBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089496, "uuid": "81cbb25b-8718-4ba8-8222-19db83487cf2", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089496, "uuid": "04d303b2-6177-4057-b215-738cc415c265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089496, "uuid": "0e30b4d0-b92f-43da-b019-2c07f4ba32a9", "value": "0cdf9c8e5c5425c8250c979a2455ea03e3266e779d784a1cfeeb6f838d363367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121748b3-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085423, "uuid": "cb6e0eaf-ef6e-4980-ac5e-ca7e19b9adda", "comment": "Malware payload", "value": "909341e6e53d5788c35756fab726273a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085423, "uuid": "6022d5c9-c498-445a-8a91-d9e5bc40ebde", "comment": "Malware payload", "value": "0d6eacc5500cb6b6f5fe5d6becf203093c1faf5c31fd5df35175829bb9531f38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085423, "uuid": "49f5b07d-15ec-4f1b-a6e2-82282c977ccd", "comment": "Malware payload", "value": "61634f4da8e3622807d4af38d21dc5fff4e41914", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085423, "uuid": "544e4a46-cece-4a1e-9c3b-169138dd748d", "comment": "Malware payload", "value": "a0f5a4857d7ba86eee583edc60719c312c4bc874a41a453f685995c2f29fba3e83c841e1a934ea638749b0c22bf601f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085423, "uuid": "eb6503b3-993a-4eda-be79-dcf9f467914d", "value": "T1F043012463C32B92BA6A8E76430C3797A0820165FB577C5FB39C6A3C81BB71B91F9404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085423, "uuid": "0ac62fdc-47f5-4653-9a05-91b17fd359d6", "value": "768:pZxyFh6vlwpHndEwGjI1p3DDDvzYMsycGcliO2X90+DTpDgrpnr3cFG3S3kVuzQj:pZxrmFdJBvYMsy0ltapDgFngQeUIIsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085423, "uuid": "25f00ffb-00df-438d-ac82-1b078491ed38", "value": 55368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085423, "uuid": "1e32208f-6bd7-4d45-b4a7-351fde69af28", "value": "application/vnd.debian.binary-package", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085423, "uuid": "e0347387-fe65-40c5-9666-52e87258c996", "value": "freesweep.deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be56fb2c-4d21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694051781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051781, "uuid": "0a419761-d5be-4d63-83c4-0bc0755a56da", "comment": "Malware payload (Amadey)", "value": "273b87a6a69528198c7e00d7e203f2ce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051781, "uuid": "bd3e75ed-aec4-4d6c-a003-81fd466e70da", "comment": "Malware payload (Amadey)", "value": "0e4f0232e16b4fb8c4b640d41a79d14e8c70abf0c206c57c6bf758e0032e9327", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051781, "uuid": "2663bd0f-aa78-4bf5-bd26-9de4ea6102ca", "comment": "Malware payload (Amadey)", "value": "1e405e20f131f5383e5d17308922b07b9a119ffc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051781, "uuid": "ffe7e223-64de-4b39-bcfb-f9729cd7471a", "comment": "Malware payload (Amadey)", "value": "42ecd6122bbe69245a571750799e18e0f21cf3e7ab63110171f6dd1047aeea335f096a37831a121bd9304deb894588a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051781, "uuid": "a7f1abcb-8b7f-454e-b85d-456c0a64afe2", "value": "T15124F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051781, "uuid": "b6013456-f845-49be-9246-b9d2d207354b", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051781, "uuid": "2ceaf8c9-a94c-4cd7-9022-d9f798f2e805", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694051781, "uuid": "1aa53dd6-744d-468d-9c93-28487206d04a", "value": 225581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694051781, "uuid": "81480da2-8fe1-4fe6-9366-104e91584414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051781, "uuid": "e62a8f88-647c-4ca9-a6a1-8fda4a9b9c78", "value": "273b87a6a69528198c7e00d7e203f2ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab17e67-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694069411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069411, "uuid": "7505d9fd-33c7-45f3-8140-b8a210a8d59c", "comment": "Malware payload (Mirai)", "value": "60a19efdd057e0a056788b3f39472c43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069411, "uuid": "db466db9-d9b3-43cb-a2c3-4e1fb13a4cdb", "comment": "Malware payload (Mirai)", "value": "0e822f004489213add5685233ea8ca0ded4347a20ef88410dbf7f320dec07ac4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069411, "uuid": "4da388ac-8ac5-4967-9789-07a7e4c7379b", "comment": "Malware payload (Mirai)", "value": "af16df536ddaf4467efbe2aaa111499d7e8b11ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069411, "uuid": "5592e956-8aea-4dcf-8959-2b3b72c1a914", "comment": "Malware payload (Mirai)", "value": "d69fceb1bfa30c709005f5b0a4f5340357c68e3d7d4157cd12d4899a68740744dd054f2ae56938fc605de11775a51d9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069411, "uuid": "b42f86a9-8887-4efb-8690-6bf0d5ea5366", "value": "T184C2D070A7AE2CB186500572F6B85AC9BE530FBDF6FE389011408BBB3941D052DEA5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069411, "uuid": "8103cd36-241c-4eee-9de6-d501760fccb5", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEtBBxqDhymdGUop5hI:A7soTAZ3alkXLvFh8nNEtBSs3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069411, "uuid": "4e538498-3974-4e41-ab0b-d14d6d2c1b8b", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069411, "uuid": "3b957b0a-65a8-4766-a721-d7d75477198f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069411, "uuid": "4116f825-b527-497f-9775-2e8b5168d524", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745846e6-4d29-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694055093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694055093, "uuid": "7e68ba6f-5f5f-48f0-b8ca-fa1a4a5d3072", "comment": "Malware payload", "value": "f7f6114abe959541a0d55c17853e91f1", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694055093, "uuid": "b283af31-60cc-4af9-97e7-c58226a87847", "comment": "Malware payload", "value": "0eb59f2e99bc4229dff4c12500f622db57744964585cd09d258a4930a5d4d400", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694055093, "uuid": "4d7e7ad8-73b7-43b7-a14c-1468309f70e4", "comment": "Malware payload", "value": "7b2fc957c43c9b16ea4ccc54267dca04418a3207", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694055093, "uuid": "646f103c-895c-42f7-93da-9af4c0a252ac", "comment": "Malware payload", "value": "bee61ec1bcfefc3aeb40aa5fc65aa1f8b122b12092b1a780fb6b81f58780897ab9afe09bd01f3807a738512eb75904f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694055093, "uuid": "50068ce5-ba4f-48de-8dc3-97a6985547c7", "value": "T11BB633C96003ECCAFD5E5C73D1FA6CC1DA2490A2E1669834A7C9B7006A6FF60C1675B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694055093, "uuid": "4afcda83-222b-4d6a-ac6e-3f9854c0f4f2", "value": "196608:zl2w4JIY3ATLWzuZKe7Ss9AMCl7hhS0DkVf3HOlyh5+dqhSJbZtOx:x5PUav7x8MZ3OlyOp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694055093, "uuid": "a775e014-b479-4b9c-92c0-5e9bb2a6e67a", "value": 10833244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694055093, "uuid": "6ac6841a-f3af-4c01-877e-d2c324564d1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694055093, "uuid": "7ed285b1-64b9-46cf-81b3-909b6f310a43", "value": "ChromeSetup.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ffb5c4-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694080542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080542, "uuid": "9eba0a87-ca72-4a30-a13c-1e8a3cdf4bea", "comment": "Malware payload (AgentTesla)", "value": "08ded35c75726b13f2e094b97b16393c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080542, "uuid": "69b464a9-d2ef-42d9-8044-e7c1e7616bfe", "comment": "Malware payload (AgentTesla)", "value": "0ebdabe6c28a3f019e3dec1cd4f8fe1aeb40adc099c33d984b7291d15cd3725e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080542, "uuid": "10f24c7c-69f5-47b8-846f-7f82c1b79240", "comment": "Malware payload (AgentTesla)", "value": "1bbfa42d8ba2823046503ae96da1c0219a823f5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080542, "uuid": "10277d3a-7ec2-4579-a3f7-377583ed8d3b", "comment": "Malware payload (AgentTesla)", "value": "378f64bc8a027e37c7cc4f72fa8f17bcf6e7016b9131986301d251885ba1bc8ddb97f405ec805c34e26592e45baa2273", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080542, "uuid": "bfc78f1c-2b50-40ba-a47d-5e4e1fe251f5", "value": "T132D4234516894F37E3B9C3F31090289D53BBD70591B6DB450EE9E2C88932F6943B38AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080542, "uuid": "344d35d2-d3c5-4fa1-aacf-393141d9fabc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080542, "uuid": "e63492f8-cb3f-47c9-8ca5-d82660b7e9eb", "value": "12288:fViP/ImmZq97JIu4zLXxOwws6QpU0SreUa2nVw5fVsbR:fV6/yqJJIu4XXxTCQpU0SzlKtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080542, "uuid": "89d42e38-6a9f-4634-a4b6-6c579955d124", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080542, "uuid": "41fbdc01-c820-449b-aa3b-0adb846341cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080542, "uuid": "46ce2af2-bb1b-4462-b0d3-2dfd739281cc", "value": "SecuriteInfo.com.Win32.PWSX-gen.25815.11108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae085dfa-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075806, "uuid": "fb05c006-560e-4f98-b31f-5e68df9e7bac", "comment": "Malware payload (ConnectWise)", "value": "63e534378dfab837362ccb2ee1157bf7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075806, "uuid": "e4ef54cd-e0ad-43cc-a706-64d3a73c7821", "comment": "Malware payload (ConnectWise)", "value": "0f1580efd85ad55cb1a5de940aeea599aa13a39fe11a385a72843cc920b94e23", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075806, "uuid": "7d509080-9f8d-49ec-ae7f-c4dca7e2f266", "comment": "Malware payload (ConnectWise)", "value": "cc455c545a7c66ab752be34f2956950a9b982a78", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075806, "uuid": "32cd34ec-1c8e-4b94-9047-493e906477d2", "comment": "Malware payload (ConnectWise)", "value": "6887a9c1a0cf6485073a1460198728ca4e27029d92494cda0340f1ec43159a6245d57254e166bb87815873b47b9a8065", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075806, "uuid": "d5e7cf70-fbe4-4877-a5a3-d8630ba9801a", "value": "T1BF836B13B4D18475E8B20E3118B5D9B4993F7E114E648EAF2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075806, "uuid": "cb1b9297-bf23-46c7-9cae-6ee2e3d8df8c", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075806, "uuid": "a1145e3d-e510-4faf-b3fa-e2b4123ac44b", "value": "1536:mazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYh709Px30Su:6FNpo6rIKlUE8fbkqRfbaQlaYYhYxESu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075806, "uuid": "25971860-b2de-4ddf-a661-b966d0fedb68", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075806, "uuid": "29229174-fd0d-48b8-ab25-b933ea962174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075806, "uuid": "4765938e-b7a7-4092-b9f0-e37d3db889ff", "value": "63e534378dfab837362ccb2ee1157bf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf473e4-4da0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694106028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106028, "uuid": "2a4f23bf-8795-49b7-8b47-5e0a9ee12e2a", "comment": "Malware payload (AveMariaRAT)", "value": "0ebdca3359162e21f83c16f0dfc7f15e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106028, "uuid": "fdae8d9f-84cb-4508-abdb-edf6de3acdbb", "comment": "Malware payload (AveMariaRAT)", "value": "0f577ded02719eb48f151789292e2275336827c1aed900902d977b929b577d0f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106028, "uuid": "3810faf3-860e-4a93-af40-089be4405a15", "comment": "Malware payload (AveMariaRAT)", "value": "c6bb77cef04d55dd4b8f4752731042fb051e1424", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694106028, "uuid": "578855fd-530f-4899-91ea-398518f656c5", "comment": "Malware payload (AveMariaRAT)", "value": "e4bd20247bca786b6f6a05f990697fb1be5fb335f4675c9876894823be328a24919699fc7310727d70617f45d5dec2a8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106028, "uuid": "f4705720-cd31-47b3-b969-d5d9a129bac3", "value": "T17D44F19B538DCF83D5A904B6D0D271F01724DCA9C683E30774883D25BD7ABDA8A166CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106028, "uuid": "de6da611-df87-4960-99c5-c1fbbb6126dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106028, "uuid": "dc0c68e5-8fa1-43e6-8e40-ca38e60b2596", "value": "6144:A+8t8PmE8TZB+Sywm1MwsrvA0WTp4xNKqwBP/DGDMDSj:AZtvCwQAitzLPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694106028, "uuid": "deb50071-8239-4829-bf03-2c039928acee", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694106028, "uuid": "2363935a-05cd-4204-8300-2d8118c5fc3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694106028, "uuid": "446d26b6-19c4-4563-a6b0-f4dbc984edf7", "value": "0ebdca3359162e21f83c16f0dfc7f15e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58906147-4d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694045168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045168, "uuid": "41400f6e-3e37-4d92-a6b8-c26fafa93fa7", "comment": "Malware payload (RedLineStealer)", "value": "31873a64f28bf6cd0b8bed5f03820085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045168, "uuid": "ff0eb2d2-2c3e-4a47-8678-9698c863221f", "comment": "Malware payload (RedLineStealer)", "value": "0f790a29b05372b1b2d8c6dd8fd199fc2eb3c26fe557ae5cf49db9ec4482f1bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045168, "uuid": "855f0299-1a98-43ed-8474-16390b4b1b5c", "comment": "Malware payload (RedLineStealer)", "value": "7e1cd5b0d62219f9434915eb411a2d20fb7c1132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045168, "uuid": "2102dbcb-a937-4feb-9af4-bbc480198041", "comment": "Malware payload (RedLineStealer)", "value": "7a4ee03b959f79e737678497b7b2d1917baa62fec5265c90aa52164b6d33e7e220cbb8e3406f0bba97e6b5c2c7140739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045168, "uuid": "e53692a1-d47c-410d-92b1-ef6362e92276", "value": "T1B0E41253BBD81522ECB227B06CF702931B397C5148A44B6E364A7A5D0DB37D4A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045168, "uuid": "14bb59c7-691a-4cbd-8d0f-46318798113e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045168, "uuid": "05e0dd88-84a1-4fe5-bb6a-43193fedfd9e", "value": "12288:gMrIy906rGGCwVFRsxrBDVkd0Wtej/FfWD/yPL6aEvE7hI36dNBrChF2R:Yyraq7c2AYD/qLCvWBChF2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694045168, "uuid": "5934d13f-84ac-4625-b188-e0abf9d9e217", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694045168, "uuid": "216810ed-c7eb-409e-9126-96d383a83920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045168, "uuid": "36b11d78-da21-4078-a827-34c9ca91b709", "value": "31873a64f28bf6cd0b8bed5f03820085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb7f36e-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694103216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103216, "uuid": "a8a95502-d0ee-416a-868c-fd90a985dffc", "comment": "Malware payload (RemcosRAT)", "value": "366431c4b55497332419488ed3cf5e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103216, "uuid": "5511e629-667a-4b99-b15d-6171c921b327", "comment": "Malware payload (RemcosRAT)", "value": "114333cac355600b7c44c6d51f84e39caaab20ededd416d8bb1e1a5f3c5cfb39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103216, "uuid": "cc190485-d81d-4e89-a690-3e1898dd0db9", "comment": "Malware payload (RemcosRAT)", "value": "2eb53d1cbc9949af1eb35ef086ba8e1700498b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103216, "uuid": "89bc54a6-9724-4e9e-bfc5-974c5d75b0a5", "comment": "Malware payload (RemcosRAT)", "value": "715fa8309189450471c1c710e2f5763717a8606d943992168569703a97fe63b1f80e52dc4b4e8257e6df7f623ad3ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103216, "uuid": "4495fa41-485c-42f2-927d-8c148f2dad4f", "value": "T1D6051252E51EECE6E61B1837843AA5194830DF1555E82A2F17643B253EB33C329BFE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103216, "uuid": "47b1f1c8-7fe8-40fc-843c-4019519120a7", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103216, "uuid": "2e48ae6d-3ef1-44d2-a7f3-f9b05625921c", "value": "24576:TyhglJCmsDVA68DqXiAsKVk0Z13z1j6qEO:XlJCXVASSAsoz1j69O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103216, "uuid": "6c388eac-0f56-4bbd-87aa-acd0c02b729e", "value": 813376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103216, "uuid": "e004f091-9638-4346-bdf5-31262e0f254f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103216, "uuid": "34e5fc7a-5055-4c07-b163-9e540964b0a7", "value": "Quotation - PO #230988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a862576-4d51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694072230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072230, "uuid": "76fd1480-a5fe-43e9-bbdc-4077ab019478", "comment": "Malware payload (Amadey)", "value": "2302c63a2b4e127d2b3b9ffb069aab6c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072230, "uuid": "5f176642-b560-4c59-b254-118cb61c2294", "comment": "Malware payload (Amadey)", "value": "116e6c0f15a6cb39f0cf31c43dd7fdfed5fc3303d155a9b9655dd0866357a781", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072230, "uuid": "a50c63cf-a43e-4ae5-82a5-cb8cc332a0da", "comment": "Malware payload (Amadey)", "value": "5037d43563c6c767ca0e9344a2df78bdf97c094f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072230, "uuid": "233471b2-033a-4ffe-be4a-25f0386ab919", "comment": "Malware payload (Amadey)", "value": "7bb9383acd38494af2cb6657d88c483800b2a4e8e0158730e4986647c39a4c1a929b546d6db66a81052100961343bd6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072230, "uuid": "d5f1668a-2cba-414c-900a-c0af033d497d", "value": "T1B4E41247ABE48073C8B507701DF206D30B767CE2EE74927B1701648B1D72698A9BA76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072230, "uuid": "54eb63bc-075c-4b2e-927b-dc5e29568569", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072230, "uuid": "342ee153-9c23-47f6-a8cc-ffe48ae2e6eb", "value": "12288:pMroy90odJAVIE6YgJTEFuA1ved4ob1c7VpBTPpe5sNZGMCErX:hyjrA37gt+uAEvwBTZZ3C4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694072230, "uuid": "9f9a07ba-e396-4d89-9530-0e16e1a9410b", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694072230, "uuid": "103fe2db-9107-4dd8-ab50-6ea46a191f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072230, "uuid": "98e7344f-cbb3-461b-9ca3-ecfc7afd0915", "value": "116e6c0f15a6cb39f0cf31c43dd7fdfed5fc3303d155a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4ff0d5-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075727, "uuid": "e94ddffd-18e0-4a62-877b-04d1c614cb99", "comment": "Malware payload (ConnectWise)", "value": "a8967af1377aa4056b89c6855a35f025", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075727, "uuid": "205de324-fe18-4cd9-9819-7cd8c8653bd4", "comment": "Malware payload (ConnectWise)", "value": "11fde532795396a5a4362e98a71725659e143979cbf0eabed1e5d1db7680cad4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075727, "uuid": "100fddb2-5775-444e-9c1a-14cad05121df", "comment": "Malware payload (ConnectWise)", "value": "66ea1cdc7d21b6cb9a4eab7007f56b16980a2b01", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075727, "uuid": "dbf0600e-ccd4-48d3-82d1-bd466cbc05f6", "comment": "Malware payload (ConnectWise)", "value": "bd640c8b24dab322df23cabd88510712cb5e8ae25f3f8d010eaf2fc65a24a7e3027bb4f90b3e61d944b3fc9ddbf1740d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075727, "uuid": "b2dd1335-249a-4d35-9a28-f3595e517ce2", "value": "T1BB836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075727, "uuid": "1fbf0e9e-3f9f-4788-b51c-0b390d40b9d4", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075727, "uuid": "db6200c9-a325-414d-9332-24e7f2842ae8", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3hk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075727, "uuid": "99f6607e-ba96-496b-9b4d-15ed230d6aef", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075727, "uuid": "a4ea94f8-0c31-4ea8-ac51-871541199fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075727, "uuid": "69247cc9-d7ca-4917-b5eb-3dc74048b5d9", "value": "a8967af1377aa4056b89c6855a35f025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08980b52-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694079394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079394, "uuid": "2bcd9622-7e6f-428e-b802-49e841a9c1ef", "comment": "Malware payload (MysticStealer)", "value": "da705c6ce8806de469cd41ebf295f70a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079394, "uuid": "1a429dcf-bf68-4523-8edd-54e6bda9f206", "comment": "Malware payload (MysticStealer)", "value": "12492f391da1529664e617aae1422057896a921cce2ff4191b217041188b1056", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079394, "uuid": "c36df2d2-8b85-4c78-8b23-c810384a7ddd", "comment": "Malware payload (MysticStealer)", "value": "dfca5ec66a56c32b1a16975561fce478ababe9f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079394, "uuid": "14524994-2653-4c6a-8e38-79d1dcd3d3c8", "comment": "Malware payload (MysticStealer)", "value": "36858dfb048d36ad1d44d57eec3d2faea2dcd54f63b4b2c854057d275d19094333ce39e21c3ee5f9888826e1459b930d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079394, "uuid": "640fbc11-047a-4eda-a356-c61282c891b3", "value": "T17BE39E01F2C2C0B1E9B3147915B1E261DF3DF93446FD5EAF6BD40FAA0F211A0D62996A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079394, "uuid": "4b3a5200-9bca-4a04-aff7-65614338b132", "value": "7a83bc8f14d32c8af61627070a00e36a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079394, "uuid": "d9fc6546-d82c-4cc0-83f3-acb83893246f", "value": "3072:ByrwPG9SiG103j9DR0CvlIM00tob89UoxqhLPNK8Z4PojfCp:g59SO10kOfLfCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079394, "uuid": "dc142754-3514-4c72-8bd4-a97c6c6d0463", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079394, "uuid": "470d036e-b712-432b-8139-d3461b454ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079394, "uuid": "ee0f3c7b-d74f-40be-83b7-26f5d61add52", "value": "da705c6ce8806de469cd41ebf295f70a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0133ae-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075133, "uuid": "c537caf7-d6da-4780-b46f-ef72e55784ff", "comment": "Malware payload (ConnectWise)", "value": "81924079dbf87e3ee2a3b956266435ef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075133, "uuid": "38709594-4c3f-4169-bf7d-16d06a2e0e94", "comment": "Malware payload (ConnectWise)", "value": "12717a6aac4c9c631d45ef45d6407c1bd8239917110f7d9713ea8060daff09b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075133, "uuid": "59ad1b52-3ca9-4484-8f5c-1fb0c74fd538", "comment": "Malware payload (ConnectWise)", "value": "cde957a5abfac8d44d36f99709260bbc4fc8c31e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075133, "uuid": "f83f91b4-ed39-4327-812f-1afdb34aff0d", "comment": "Malware payload (ConnectWise)", "value": "bc7be13d8f8d7399083fea212a988afab6456d9e1269bb62b797331cc8ce568a8b48726b8217a3444ba701d0aa1439a0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075133, "uuid": "c6ff4a3e-161e-45da-9be9-031358b974bd", "value": "T11846F112F3E585B5E0BF0A38D87A46669774BC084622C76F5394BD696D33BC08E26373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075133, "uuid": "e637bcad-0788-4df8-9892-2b32ca5cc13e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075133, "uuid": "23b034fc-64c2-4c4e-8ffc-a90ae4294462", "value": "98304:W0sHN6+6efPDD+wRsNJQpC0FodYds1vGuLAvy5LvGUd+:W07efPDD3ONeCeon1Zsq5ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075133, "uuid": "ed2e0da1-739d-4a20-a1c7-5e53848ff2df", "value": 5387016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075133, "uuid": "7610d86c-5126-4bea-8d5b-86b0315c37b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075133, "uuid": "d3ab1034-3542-49c4-8be5-b4d6dac21150", "value": "81924079dbf87e3ee2a3b956266435ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1def9ba-4d73-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694087006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087006, "uuid": "d2728907-705a-4d75-a416-66b31b185df6", "comment": "Malware payload", "value": "bc567eebe3ac1fab39683739f2605de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087006, "uuid": "3a3e039e-5fe3-4636-b19f-fa1d2bc928b8", "comment": "Malware payload", "value": "12d196ca5e5255a22d6bdb2d6f11fe429c1ca87e24590f3102800fef914af937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087006, "uuid": "7eecef41-d871-4eea-abd1-52c6b5d719b8", "comment": "Malware payload", "value": "5db3874ab101bde58b9300e62f92271fe3f8081a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087006, "uuid": "9877fa78-3ca3-4eba-9319-db515c46bf02", "comment": "Malware payload", "value": "e820800b716e8a0bdc917a972825d4fa634a45c4ec64248659e060757edda566aad9d2474b479776acc9703cd494c603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087006, "uuid": "e7213320-243e-423f-ba0f-07afe9c6ae9e", "value": "T1BD6483462E8CE131DE7016BF2CA816BD6ED14BE9E62239C2D794D15F08DFB1009EF5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087006, "uuid": "9e9d2663-25bc-493f-b184-10812dbc80bc", "value": "a1cc62e835b33603cdb0c85361e688ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087006, "uuid": "75d99d36-521a-471e-b3c8-e39d12399301", "value": "3072:1YUb5QoJ4g+zp0iBtTy06ZjKIz1ZdW4SrOLVSVpP6eTr0:1Yk+tT+hKSZI4zLVSVpPzTr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694087006, "uuid": "740a4d77-3771-4bdc-b5af-c467906cf801", "value": 316837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694087006, "uuid": "47ad0151-6097-4ac6-a6f5-77e044dd4e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087006, "uuid": "a88c25b6-0d73-4a02-9153-c2187460db47", "value": "Trojan.Autorun.ATA_virussign.com_bc567eebe3ac1fab39683739f2605de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfcf979-4d41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694065468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065468, "uuid": "852517bb-9af2-488f-9dd6-d6431baeed64", "comment": "Malware payload (Mirai)", "value": "40d02d2f5785f8957dc6fc3a5c692c17", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065468, "uuid": "faac5201-c51b-4a55-93a8-69af043315c6", "comment": "Malware payload (Mirai)", "value": "13e2950980fbb37a1419f3ef4bfd585407be73b86171671af33aec7e4b28ee5b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065468, "uuid": "b0086e33-e6aa-4bc0-94d0-9e5a19bd2a5d", "comment": "Malware payload (Mirai)", "value": "4fc8a1c8801cf642aa6253e860078de039368d60", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065468, "uuid": "251c9d85-1aac-4cd4-9f93-de80ab73d1bf", "comment": "Malware payload (Mirai)", "value": "1dbf74fcc48f0b701f852c78fe416c61cb3e9c04d990991d4944be8c69e8300f79d4b9864cf5cff80ba08b8904ab140d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065468, "uuid": "286572fb-73c5-4b21-b3c6-763d702811d2", "value": "T11303E0BB863BDFB0D53696741FBA8A81F871E4025C05672719CAF43DBCF32A1A921741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065468, "uuid": "a6097440-3506-4fc4-b8ae-c3c07cc1670b", "value": "768:JLUKk8RR99dBJUL55xOVoPiUmjDVGPl9VqRv9sPV6u:lxnR9NJUL558U3rVCFuV6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694065468, "uuid": "bc0f3573-8fc3-4eeb-82b8-8a1f0d5be346", "value": 38688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694065468, "uuid": "562e5d1d-defe-435f-8e10-ff1c4d40a1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065468, "uuid": "031ff4b7-74b0-40c4-b75c-d33a900a6310", "value": "40d02d2f5785f8957dc6fc3a5c692c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59ac7d2-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694080543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080543, "uuid": "64a8fd59-cf79-47e9-848f-3cd09915f1ad", "comment": "Malware payload (Formbook)", "value": "321411be635881997a6db96db04f9b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080543, "uuid": "826d3f02-ab6a-428d-a309-aa0a41c27810", "comment": "Malware payload (Formbook)", "value": "13e982225c8c2c3a496943c893f68f5df437a2fec9a1709648ecb57f99c1bd3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080543, "uuid": "481ba961-d4c9-4f6e-b700-4d4335dadb6f", "comment": "Malware payload (Formbook)", "value": "cba61a1b3b25bd8d7e5520ae2b81889702ef07b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080543, "uuid": "3f8c06cd-5e31-4642-9b93-0e3e48869199", "comment": "Malware payload (Formbook)", "value": "9a2e0bb528898c65413f9cca98085874afc288093a272f55a7e9addb92186e6079965c12cd5bcf58bbc3cbee4f3a6c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080543, "uuid": "4bed72e2-6ed1-4570-99ef-c8fe46bdfa37", "value": "T182547D00B551A136E87319320FBD6659963DBA600F046EEBA3C85D2DCF356E1BE31B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080543, "uuid": "4da36743-ab9d-402a-8dc3-5a3b6f1eb7eb", "value": "760c0ea399376392700ec8685e5ecb4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080543, "uuid": "bdcc2bbe-b3d8-4e01-b71b-5b55a1fa9464", "value": "3072:cuoNBw0l8T1cLonL4Z+O6HtJJXW6Qy2awyFpgApmhjFXMxGPqRbUa3vtQZAg0Fug:cWT2onZweJEjFXoUiwawAOHIU/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080543, "uuid": "2e924176-11e1-4309-896f-c67364628627", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080543, "uuid": "99be031c-2ee4-4887-bb05-07f3a8fbf356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080543, "uuid": "f539874e-c348-4db9-83bc-f54762ad6642", "value": "SecuriteInfo.com.Win32.PWSX-gen.31833.25998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a36abb-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694090237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090237, "uuid": "0443f8de-ebe7-4530-8e8c-c51b2c33ebf0", "comment": "Malware payload (MarsStealer)", "value": "7d316cee94acaa0bc67a21571bbc00f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090237, "uuid": "665a7feb-2796-458d-829d-4863f65cf2ce", "comment": "Malware payload (MarsStealer)", "value": "160904f1153bcacca335d7469ae40d09fac4832ffe2c0cf464ec184132239591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090237, "uuid": "eb1944c5-60ec-4a73-aa8d-911f5d09da47", "comment": "Malware payload (MarsStealer)", "value": "0ca4ec09e32962d3d1c5338d12b7352d92d7c828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090237, "uuid": "c592abbc-7721-46aa-a417-b73cef9ddf96", "comment": "Malware payload (MarsStealer)", "value": "6f8e9c910075b3aba680fa99e0666da0e94bc7dadc56d895e09e80cf7d96b235937f701c339111f60f07c4638733b486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090237, "uuid": "d480d70a-0f19-48b1-aab8-98edc55d660c", "value": "T1B2646C13A2A1B871D5274E318E2AD3E8261EF9E14F1576EB135CAAEF0D7C1E1C672710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090237, "uuid": "c6f81691-4818-4896-b769-bc10e2582497", "value": "6200f2b320af277fec49ce04b92f1379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090237, "uuid": "e655d027-9f69-4ef0-86e0-0b5ff6df9998", "value": "6144:Y7XSz2OFiX9Qa4nIBM8zDBKgN0q5fDEp7OsYO:EzOFmqhIOmBKsTDc7Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090237, "uuid": "0315e241-26d5-476e-9d42-102e64845b8d", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090237, "uuid": "3deb4b70-4fcc-415f-8388-1f46ec913fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090237, "uuid": "5a508fb4-af1a-439d-b231-e5a717cbd3ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e6a3c0-4d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694082444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082444, "uuid": "dec523ec-19b7-4d3c-b0e4-e48e2dcb3c45", "comment": "Malware payload", "value": "be55f6095515123838e02085c81b0acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082444, "uuid": "ddac26a4-6179-4759-981c-a9ca3e8dfb54", "comment": "Malware payload", "value": "160c2544013ba8b66b4989c66bab3b7c2a1dfbdf296d21d3d2b7cc9a636f2537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082444, "uuid": "27425744-80ee-4744-a5d3-70269da5714c", "comment": "Malware payload", "value": "df45d0a87894448f2e18a559b2dd71c573b9e4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082444, "uuid": "264a866c-dbc3-4c78-906d-2bdf764541b5", "comment": "Malware payload", "value": "cd17b5c057388c3dfa850cc97f28827782970662ed3f1e353db7b830e75a151dcbf686d721db0274d85c12731f64fbda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082444, "uuid": "fc7646e8-8c4a-4191-824b-2cc1539d5275", "value": "T1F6469C66C01961EDDAA90437F616070569BDD6138BAEC5FB8B2F2D390F135CC98BDB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082444, "uuid": "01c1af13-5ff8-4bbe-97a0-72faa9df214a", "value": "48246eb64cb05f56f073f843df37a04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082444, "uuid": "c990f8e3-7993-451f-92b3-0b3aa14a86e3", "value": "98304:fcLukjT1tg6GkeEkIuX1yt3PoXf6Sx0wM1AtLE9wP6mW888uYmGbJNv:fiuqPDGI9PUphM1xaPRWLGmaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082444, "uuid": "78ee4bf4-f738-492e-a41a-1aafbd180477", "value": 5880832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082444, "uuid": "7be585ad-b4f7-46c1-8d7a-e7ca8e7e39a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082444, "uuid": "fc805be7-c5af-4e8e-b85d-77cd84c8f5cd", "value": "be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d971e7-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694090012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090012, "uuid": "a5f07893-129b-42eb-8fbd-2b95d8afd42e", "comment": "Malware payload (AsyncRAT)", "value": "4e154ea9eaf59e0cf06f47d69b869e93", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090012, "uuid": "8050439e-34e4-4910-8426-985d9ecd2d99", "comment": "Malware payload (AsyncRAT)", "value": "1692b16fb4412febc34e86a02605d0f05af0c10a55b4e8c65505f71a68364b69", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090012, "uuid": "b3735d4d-431c-4878-bf53-ba911503c264", "comment": "Malware payload (AsyncRAT)", "value": "eade103dcff49734c7b6326eb999d04f1d094de2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090012, "uuid": "b077a409-ab00-4ca6-aea7-886e84694310", "comment": "Malware payload (AsyncRAT)", "value": "566a902064c63016f760e42adb2a8dfe7cde31c88b608fa3417a429da2c53274fa2a3cbe92c709be6ec552538a10868f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090012, "uuid": "6a729622-fc9e-44b3-905c-91764ac50f65", "value": "T10D01BD61F05EFFBB4086B76A48DA5CD0E4B8828B0370F4467112F102C07D9BE5C9A5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090012, "uuid": "25cc0fe4-7855-4f5c-911e-7ea9a98a1a08", "value": "24:E1FvNp14Lcn6G2EUWOg2Rhh1/cGss0MgwR:E1FvN74Lc6DEU/V/c79M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090012, "uuid": "d45eb645-35bf-4553-b5ca-867377bf051d", "value": 819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090012, "uuid": "6a71f643-14ae-42b5-8137-c88335af1e51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090012, "uuid": "7099e67b-80f7-4a24-9bfd-3376e9b2b810", "value": "3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178684ee-4d86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094881, "uuid": "583c2b96-5856-43d5-bafd-f6b3be2210ab", "comment": "Malware payload (AgentTesla)", "value": "d69e5ab70f1bf241ede8b35503b61db7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094881, "uuid": "5b5d96d0-f833-4e62-9eeb-744849420778", "comment": "Malware payload (AgentTesla)", "value": "16a976bb432be2baaaa0f6d32dbcbb00b823746a35561e3e8708bf0312515ed4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094881, "uuid": "3922c9f9-ce15-4d39-8bca-383ae7299777", "comment": "Malware payload (AgentTesla)", "value": "e7b00334209a23fbbedf92ab83df7a4073fbec0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094881, "uuid": "8e80e46e-0071-4b28-9ad8-27d229975772", "comment": "Malware payload (AgentTesla)", "value": "4a261ab12497d376dbcd0cdaef5b3b9eeab0d35ad21ad021c79c05407fb491273d1ba230d8f2facb49e18ac5e63f033a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094881, "uuid": "bf49f233-3e27-4fbf-8857-dd1d4547af09", "value": "T16734DC137E48EB55D698393782DF2D2423F1A0C71773D60BAF48AE6569422837C6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094881, "uuid": "c9bdd269-bed2-4ed6-91ac-d0c35b1eb5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094881, "uuid": "8fc5b4e8-6cad-4d73-a204-2a3d11afe337", "value": "3072:CeCupIscbuAS6ERgSFmYDfEbXap/SMtw4E:hI9buASLRgSXDfUY/Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094881, "uuid": "c63556a6-d36b-4abc-a701-d538242e79e1", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094881, "uuid": "f660f512-efcc-4ec5-bc94-110439c399c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094881, "uuid": "4acad41b-c56a-48e3-b588-85a74ebcdb91", "value": "16a976bb432be2baaaa0f6d32dbcbb00b823746a35561e3e8708bf0312515ed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d779f6-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069103, "uuid": "ef3e842d-7ec0-4b5e-8b25-abdafff4dec7", "comment": "Malware payload (AgentTesla)", "value": "cba2343cdb488b46e3ec75970eef096b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069103, "uuid": "770a279e-a990-4a97-96c4-6eed18af120c", "comment": "Malware payload (AgentTesla)", "value": "17a9e377f1a8abdba24292372a1a4630383438b315b791988ebca48e8f634abc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069103, "uuid": "ce3e9be4-ff6d-4f59-a950-2feb99411c75", "comment": "Malware payload (AgentTesla)", "value": "fb3dc1463ad5414a1bc8d817ffdb3eb0aafeb003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069103, "uuid": "84d18f2c-f7d8-4dc6-9798-92eb77e4cd88", "comment": "Malware payload (AgentTesla)", "value": "711e201a59c39f4dd84a2686210c4a029e5619f5b5381777914ebd343c699a2cf07544cb3c944e64a39f5579f9cc271b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069103, "uuid": "da843b80-0f97-4167-88a6-00ebf6724a42", "value": "T193C4122FF2C850D8F5B73B764D1844B54690E249F723CAAAC915C42C7E86EE9839C1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069103, "uuid": "92f63aae-f942-4f8c-8413-e6cc9cdee5dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069103, "uuid": "d3dc7447-c584-4098-b20f-ed1df61fe63b", "value": "12288:m4QJZpEuzUjiQ2i+a3/QTmR4OZssJyG0KHMaV6ll9eDk6OhL6h:m4a275+K/SmRBZssJy03VQ2DaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069103, "uuid": "a4ff7068-3d3d-4a50-89c4-86a5bc6238d1", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069103, "uuid": "c30d909e-5256-4c03-8368-8b4d887e2b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069103, "uuid": "5b0dc9f3-6333-4eff-82e4-1663f52f9dcf", "value": "41570002689_20230906_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ec85c4-4d48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694068330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068330, "uuid": "c146c821-cd05-4d04-9cea-0e6ac1f7bcf6", "comment": "Malware payload (RedLineStealer)", "value": "1972a16e0f24b5e80144e69d87b7726d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068330, "uuid": "9d0d9387-f13e-43fb-a0d8-f063976dc9ee", "comment": "Malware payload (RedLineStealer)", "value": "18538f95d7935ad94fc402b63af28dc557d811b062f896a7922ffb8cb5863a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068330, "uuid": "08e0fc57-dcaf-47bd-9e89-244855c78b34", "comment": "Malware payload (RedLineStealer)", "value": "d251186e48e8cd3c9ccea6c2fa11b17493f9bf53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068330, "uuid": "f1843231-674b-4b99-a30a-ed418c3ea302", "comment": "Malware payload (RedLineStealer)", "value": "c73ef62e5370c83c3f8e02aaa872489a479433604b7bb9930415b52b2bd966f42161751c9a07aa55d5d515181827c69e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068330, "uuid": "78ecad9a-7acd-4690-bfae-fe2f68797219", "value": "T1A494F122B7D2C033D16352345AB0E7B15B7BBCA18B70A5CF6B945A3E1E713C19A3534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068330, "uuid": "edf4eaa7-b8db-49da-86a0-f1b573864597", "value": "b47cf3c5038ad34425cf7f361b3395f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068330, "uuid": "63bd2bd4-7c19-4fd8-ad8c-1bb5ac031314", "value": "12288:k2zZZ6DD5VUO4aLmomRZiRLSKf33bAxi4j:zdZ6BDzKomvWf3L2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068330, "uuid": "0c5d515f-59c1-4002-93f7-07e996602da8", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068330, "uuid": "723a86f3-196b-4b3a-8127-5fce8fab3026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068330, "uuid": "0faafa95-44e5-427f-9679-1ec89751924f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7c3060-4daf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694112604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112604, "uuid": "94042488-5ef0-457d-bf86-2d1fb180a960", "comment": "Malware payload (Mirai)", "value": "9078b0d5657586c69678cda8a85c5fea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112604, "uuid": "7a73cff6-4597-4f81-8d65-c462d25138c4", "comment": "Malware payload (Mirai)", "value": "194d4510e4715bccfa78c6d2753fdefd63a0ffb00f45af3a4055c48b7bde865d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112604, "uuid": "d2d4ef10-bc5a-468c-8ffe-eb31f1dc283e", "comment": "Malware payload (Mirai)", "value": "1f5a6445e7345572edcffe2e980ecfabde91d50b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112604, "uuid": "52de7032-633f-4a81-aaad-70f307dc7d1f", "comment": "Malware payload (Mirai)", "value": "7616677da13ce14c15e95815ac9548d2ddfe0ad3eacc5fe86c1f35a8e50ba78fd52e6b9d8d8c6cae79a88308cf4aed5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112604, "uuid": "57337657-9c76-47fd-ae5f-20ab79953329", "value": "T101D2E184DA74DB2BC4ABB232281A7612C625B73E70D5C9A57CE4381B45B793057EC363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112604, "uuid": "70f4c664-edfe-46eb-8ec7-9f25a599b512", "value": "768:ELZW56tNDAFiY4FGG1Nn8MPDEzg6cHoC5IsjnbcuyD7U0/2A:FMtmij8wyVcj5pnouy8jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694112604, "uuid": "1c10a42e-c8ea-4f7d-ac0f-f26a12a0e78c", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694112604, "uuid": "0e723bb2-b739-4b20-8f36-08f81419ea95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112604, "uuid": "2c1a39d8-1104-4f95-bbbc-623ac0cca50c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11645ee-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694079703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079703, "uuid": "1b8cbc0a-065e-4537-b5d1-431045ba4cfb", "comment": "Malware payload (Formbook)", "value": "9e621dabf65534dfc620eb0c70f6b7a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079703, "uuid": "9edeb7ba-ef46-4e4a-8c3d-9d01f88ebece", "comment": "Malware payload (Formbook)", "value": "19645ca60a20f1d79cfbb173d8c080a63ddb18db73498a8be7ecfae4d4d7e1d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079703, "uuid": "01b11468-c344-4786-ae3f-c2082a2c10bd", "comment": "Malware payload (Formbook)", "value": "ca4ce260def07bc2a0158208aa1f9362499764f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079703, "uuid": "171fdf09-4dcb-41fd-b8f3-be21c06eb337", "comment": "Malware payload (Formbook)", "value": "3a222538494de09538323ec8102025e5bf091e21b1b87418337be9bc410c2d28bccabb63149558d22e832000f6afc614", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079703, "uuid": "4ceace02-910f-4c74-8405-d06e12617516", "value": "T10DD4E0F91426C7EAD37493FF54A794308A63BC64613056ECB77D32980EAABD31902D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079703, "uuid": "b9c9e8b3-c084-4161-935e-35028bae89f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079703, "uuid": "9064fbe2-c183-4488-8e06-73aa2389a3f2", "value": "12288:F5fVsbR2Vc+sYaYMWFgSPOQgxArMdAbF3GgFIgZvE+7kbuG1OfOo:FtO27VSSmQgxsMdAM7gZWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079703, "uuid": "77dbde3d-670d-4035-b552-2756bccf45fc", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079703, "uuid": "9daf05fd-5e46-4674-b4d0-f70ebf59fd05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079703, "uuid": "15beb8df-68ea-4701-b959-2dacd79251c9", "value": "9e621dabf65534dfc620eb0c70f6b7a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebd41ad-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694079404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079404, "uuid": "1a7c9432-b063-4b72-9842-80d2ad3a65e4", "comment": "Malware payload (AgentTesla)", "value": "302822808680b13287d8d8942ee6dc0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079404, "uuid": "549c7107-8386-41ec-90b3-55b2a9863556", "comment": "Malware payload (AgentTesla)", "value": "19ae655449139a82f523d6c649b61d238db3cf6e4453c0a7deb2cb8caa540b64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079404, "uuid": "301a6ffa-d0b6-495d-9a44-c4ac74c64518", "comment": "Malware payload (AgentTesla)", "value": "13cb523640a3cbd414445a212f1495bd2772b9d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079404, "uuid": "9df0ac99-db1c-437e-9466-31a598ebd6cf", "comment": "Malware payload (AgentTesla)", "value": "6f8cbef296bc808bda0823dbc79509eb877ebd5d55cc02d8131686e8c42cf756c7cb45db90f5479864d427abdf80cc9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079404, "uuid": "5df930db-f07a-4f6e-87ac-ae6d3ed98611", "value": "T1D643686DC34F0169CF5652779B260E0042FCB77EF34452A5306C937533EE82DAA262BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079404, "uuid": "2a8b31b9-b1fb-4b9f-b4d2-2de31516f1b1", "value": "768:2wAbZSibMX9gRWjmJjBjHHiPfnhRno9hO6TcpwN8Rm:2wAlRBLIfn7no9hOO8Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079404, "uuid": "a19db46b-3f0c-40eb-b1cf-a4052c48a207", "value": 58606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079404, "uuid": "2a029e9c-b402-4168-baf0-a2541b3d3649", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079404, "uuid": "8d299938-7cb4-4956-9bce-1f65da660ce2", "value": "302822808680b13287d8d8942ee6dc0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b30ef28-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085062, "uuid": "6b9f0170-dced-4d07-b5ef-bc54ae5ef243", "comment": "Malware payload", "value": "7cab44431241c4dd51ccaeecaf1620cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085062, "uuid": "743021b9-d964-4eba-abe7-c5585ec0c8b1", "comment": "Malware payload", "value": "19b05882aa02c65bbd1f6eb8ef711debe8cf653673d409f71d1414c7d64fa35c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085062, "uuid": "38fd95b7-2852-4fcb-bf3e-7da34b5b67a2", "comment": "Malware payload", "value": "ee77ac22ed88615d82e62287e1cc330571406f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085062, "uuid": "f7a4d613-e375-44f7-b4d6-0770e74ca817", "comment": "Malware payload", "value": "f734000ecac333636ec4b9013470b41337ec5179f4f6f999a6fed00a46f5ecf258ae6128bc27360a27b31c23c40253f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085062, "uuid": "33f7801b-5bf5-4bb7-99e7-a5109bf43c56", "value": "T1D8A4C46DAF8479F2CEA41CB747731631A735E5C8BA1C4DCB830CE6AE09259095D29F0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085062, "uuid": "e9e4126c-dba3-49b0-8a9a-ddccbda85f95", "value": "08bca23b44274b89c6980b3fd0bc0ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085062, "uuid": "17d083d7-c36d-44f3-9c94-c20955e7ca58", "value": "12288:aTst31zji3wlwdYVL2LdDRZTB32vJ6EkIVbF1zza3fuMXyq9nVv:aItFji3wlwdYVL2LdDRZTB32vJ6EkIV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085062, "uuid": "e5f5d84d-4c0b-4d4d-8a7b-549b4ec45b63", "value": 458806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085062, "uuid": "be763332-b5f9-4a48-80f7-ae68f28e6967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085062, "uuid": "025a7296-36db-41e1-a231-c908474a2abc", "value": "Virus.Infector.ATA_virussign.com_7cab44431241c4dd51ccaeecaf1620cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a0db35-4dd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694130336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130336, "uuid": "e71ecd2b-b0fa-4dfc-b2ba-a90ad0b94fc2", "comment": "Malware payload", "value": "517986a4103757da4817787f77d5a183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130336, "uuid": "5f35b2b0-cf56-425e-bdc9-7119ee80f361", "comment": "Malware payload", "value": "19bf92ede148d3bb07ed38d5c8a8d07c1d30ac5607d24a7f417684070c10c235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130336, "uuid": "902b4c7e-ecb6-4480-b65d-36428d3ff054", "comment": "Malware payload", "value": "b93ad05fc9795bd31b4ec3f3039b9a4302238543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130336, "uuid": "fa5228b3-acc7-4c7c-a11e-8512c3c7756c", "comment": "Malware payload", "value": "d6b6597352c886ef1b6bb5bc9d7b70efcb7d9f6c1f82763cc815d4354c8108521acad24cbbb645c69ef32d9d671bb5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130336, "uuid": "401b4f83-ee26-45fb-8710-1130b475694d", "value": "T11444AEA032D280B2DA5219F334109E614A35FC314F5CDFEB935C1F231A9A9D79A366B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130336, "uuid": "d02284d8-77b9-4152-8d0e-b22c3731b49c", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130336, "uuid": "76295221-fc43-46fc-adc6-8959f9f4f01d", "value": "6144:UT6PWz9nd1kCh2EonhGqyxuuTL9JkfCu4NiN8vqtZ:U+UHkCbHJkfCug2m+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130336, "uuid": "93bb7c8f-58ee-434e-bbd5-dc4bba7f8b63", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130336, "uuid": "684bcc5c-8645-4a4d-98d5-aa9da71168b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130336, "uuid": "52370286-d03a-4a70-b2fa-6f3c83e2736d", "value": "SecuriteInfo.com.Trojan.Inject4.60850.22324.27396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c82e9f-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085053, "uuid": "47d863a4-611e-40a7-8633-c85026ea9926", "comment": "Malware payload", "value": "2c914ae100bf2ab7a81ccc57a27544ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085053, "uuid": "5a9e3db5-79bb-45d7-9c98-775f9539e29d", "comment": "Malware payload", "value": "1a16c09c612e9d7e67c20beca923ffbfdcb6ed3ff43cafb2a55e544d656f178d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085053, "uuid": "91f745ec-2f78-494c-907b-621f692dd281", "comment": "Malware payload", "value": "5957aa7ab37303dda419677bf25035a4e7590fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085053, "uuid": "46b43214-cb68-4cb2-b485-01af302f288a", "comment": "Malware payload", "value": "4e558e9e716ca0929a0c05b12a0db154e8cc644f6ba38e6f929e2ee29e5807a89116c87b6be95983e3112ff467acb8d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085053, "uuid": "819ac7ee-edc8-4fb9-beef-32ed104e1357", "value": "T14DB49F71F7D09537D1371BB88C1BA2A9A8397F102E2864467BE81C4C9F397D139292E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085053, "uuid": "012712b3-bd7d-4a87-a908-16fc886d0780", "value": "9a06f0024c1694774ae97311608bab5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085053, "uuid": "78bb51bf-bdf5-4b96-88e2-b1b3afc6173e", "value": "12288:irMIztyCq5xcCBGHeRrNbEyWYa0Ie1vUxyVb:AZyCgcCBGHeRrNj9ay5Tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085053, "uuid": "1523c1a2-2d8a-4bbc-bbca-8ef7224ad290", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085053, "uuid": "f227c382-73e2-4547-8c6c-9d236ce5cfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085053, "uuid": "fbcb9881-ed78-4c3d-9e67-134de4da3cd4", "value": "Virus.Hijack.ATA_virussign.com_2c914ae100bf2ab7a81ccc57a27544ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d518a7-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694103338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103338, "uuid": "ee56943c-2eb1-45d7-8049-3cc4f6c8aec7", "comment": "Malware payload (RedLineStealer)", "value": "9a319e1b1749cb6975296384f0307254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103338, "uuid": "3774d3e7-32e0-46e3-b643-6476b4c72174", "comment": "Malware payload (RedLineStealer)", "value": "1b066586603f7de568a4e1e5694cdbbf3260980d82a280d5fe3ced313b9881c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103338, "uuid": "7c196b97-d95a-4515-ae1f-0af91798befd", "comment": "Malware payload (RedLineStealer)", "value": "b4b0073a856a55aa5886a2ce33fb6ed4fab7d07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103338, "uuid": "c1b5d49c-5950-4898-a5d7-98bd5cbb3da6", "comment": "Malware payload (RedLineStealer)", "value": "b7ea5f41c2ea98a8375e105946e157656e2dae14860db1fd5a3829f3bf430b538fc2255e0e2cbd8f2ba536faba8d543f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103338, "uuid": "2e6b21b0-460a-4b3e-bd4f-82789a030f80", "value": "T1E6B4AE0392EC6B71D5E306398E6EB2A4261EF8E1CF54A7EB23549AEF0D701E1C572315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103338, "uuid": "46e356dd-5c9f-413f-9e5c-3c5ae2e7f82d", "value": "e77054925f91bbb709fc17135ae0c093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103338, "uuid": "4be917e0-98b5-4414-8389-ea5c8afd3402", "value": "12288:XHvcMM+BOQwv3M5KZgUeAo/RPW2Pz4WIIr:XPcYB9wv3iYeAo5T4WIIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103338, "uuid": "433b05aa-4e3d-4b02-a2d6-0c2f8cf82429", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103338, "uuid": "5c96281b-3e00-438c-912e-665c33c56cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103338, "uuid": "326c83d9-1605-4615-923f-6e06887c1596", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f854ff1-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069151, "uuid": "34a896f9-2b24-4a02-b9f6-cbdd158d4f32", "comment": "Malware payload (AgentTesla)", "value": "033ee77afd411d78cfd271a2a2572828", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069151, "uuid": "430dead0-a800-432a-baf8-10a2824bef76", "comment": "Malware payload (AgentTesla)", "value": "1b51299ac863ff674c4c6f8aa2390544341a340a5c39a59beeea8f201eb4cb5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069151, "uuid": "d08d5bad-aa84-4078-893d-1e40ecb08b11", "comment": "Malware payload (AgentTesla)", "value": "0c3c1afe7f980d8e7206285ddea4fd8db2c6e114", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069151, "uuid": "1ce070fd-a650-44e0-9375-cb21a0ba4eb9", "comment": "Malware payload (AgentTesla)", "value": "aa93cb1ee9282251178bc4b9ac96b8a085410a2ac55d56886f81974d60316dc533c4ec194dd94d7a98fa9657cacbb900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069151, "uuid": "17543ae0-8a82-435f-a6ed-43b74dfcaff4", "value": "T16CD423086A326B31D6B903F7144530590BBBEA167081C97C0FCEF4C6427BB9DA3A48B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069151, "uuid": "debf4dfc-54af-48dd-ad4d-b66b8a035fd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069151, "uuid": "6523e979-e8f4-49ae-b441-22e598104c2d", "value": "12288:Bni9aV50UNSEbwUWjp1vmA+8kveI6uxMW5/0v9z8rZ116tnqwq0UvWPvQ4M5fVs1:g9aV50UNSRUQ1eF12BuxFC9z9tnqwq0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069151, "uuid": "13eec0ed-d4dd-4719-94a2-fab12f145f6c", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069151, "uuid": "46e7cd90-dd2c-428a-8ca1-1e43ca987f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069151, "uuid": "cdaf91a8-bee3-4294-a34e-40ceeb615974", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f61df2-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694085743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085743, "uuid": "2731f20e-7d0d-4897-b894-1664447ddc14", "comment": "Malware payload (Amadey)", "value": "9662830f68ea44c1fb92904e2d735468", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085743, "uuid": "5fd7b790-63bc-420e-8be6-abd7dbe34bf9", "comment": "Malware payload (Amadey)", "value": "1c0aacd5253ff3af443c797b675274f24e616f28d8ef80664dc01f660838aa61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085743, "uuid": "a20393f8-869e-442c-867d-2982ddb55388", "comment": "Malware payload (Amadey)", "value": "ecdd7a514fe2f872a3bb0d702bcf3d827773f08a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085743, "uuid": "b5cadeae-d177-4e8a-ba11-efe201f890b2", "comment": "Malware payload (Amadey)", "value": "2e7036033c4a6a1614ada868d1015735a228fa443255435d3b6ee2ca86a271ba871da3bfcd2946b770a1450f67a0a46a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085743, "uuid": "b9656801-6f9f-48ef-a798-76954ca5ea12", "value": "T19C052396ABCC8473E9B6737058F757831A3ABCE0A9B643463795D94D0CB2284B53433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085743, "uuid": "41a0704c-bda0-40e2-be6a-e47e1c8d4621", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085743, "uuid": "a9535031-ded8-4e04-af45-d8b5f6c865df", "value": "12288:zMr7y90sL7vKlbSyNhB/q7Vfzi234eDWfR9R1a5J1WHnNretBtmVcy+UC:MyjL7vK9h8xrnXkR9RoDmV1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085743, "uuid": "47f894a5-fab0-4375-a256-bdf3462482b7", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085743, "uuid": "a07e0ece-ce8a-4e21-bcd4-e53ebae15d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085743, "uuid": "d1157ef9-0117-4aad-92b3-6af8d1741a4a", "value": "9662830f68ea44c1fb92904e2d735468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24ec236-4d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694082739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082739, "uuid": "bf66ba36-32ba-497e-8cbb-92817f6030f5", "comment": "Malware payload (Amadey)", "value": "1bd0c3e5169ea1e33e2aeaaadccd7404", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082739, "uuid": "fac50510-340a-4c56-b671-dd11ff258ffd", "comment": "Malware payload (Amadey)", "value": "1c1f54ade496fc693c53b81f3c381a3a172a84cc11e178d43b9d57a0b8834ebb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082739, "uuid": "f36bcb12-e31f-4287-a7a3-d1d9a0ce8352", "comment": "Malware payload (Amadey)", "value": "170f6e90b959ea95e4b0a3f9c0286fda625ad15d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082739, "uuid": "1ad3ee48-3e93-4493-8d95-cf47009dd278", "comment": "Malware payload (Amadey)", "value": "59175cee400f56b675ae81c8b29e4f074ad1b0fa6a0bce904a9387b92067e95e4f6552d6fe3b7734709975aa4f838e46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082739, "uuid": "cb256412-af5c-4487-9aa9-c9e536846f81", "value": "T1750522526BD89573E8B517F444FB038307327CB05DBC874B2799A8AD18B2A80667732F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082739, "uuid": "f8deb5ec-75bd-4d73-8c3c-4c2c71ecdab3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082739, "uuid": "6f96da53-b62b-4e0a-a698-2cb4b75aaeb0", "value": "24576:OyyJn4jllSyiPPCZ52IJDrSm11hkHExrRbaUCsOyQDlf:dKn4xkC7lJfSCii+UneD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082739, "uuid": "b640849c-11af-410a-813f-e078509dbcb8", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082739, "uuid": "a99f5e4c-540d-4249-bf75-a67ba56d8fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082739, "uuid": "d3364518-2c29-4c01-9040-39a1aeb8313f", "value": "1bd0c3e5169ea1e33e2aeaaadccd7404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c5d131-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075176, "uuid": "b8e2f247-7332-4172-913d-d6f2927b7f37", "comment": "Malware payload (ConnectWise)", "value": "8364ed9f0d16bb8496aef92b2c5e88de", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075176, "uuid": "3b5d9c1e-88cc-41c7-8481-1871a9101e9b", "comment": "Malware payload (ConnectWise)", "value": "1d24c3d7ceaa81767cef0649a8800bff1e3a905812447ab6b15248c761414b42", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075176, "uuid": "b39b6627-d755-4a25-9ee5-0ea027e46f88", "comment": "Malware payload (ConnectWise)", "value": "7ea82a1f60a53c9e30d4d5b74e9553608438ed9d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075176, "uuid": "5076d751-ff16-4105-8406-23f5ad09b75f", "comment": "Malware payload (ConnectWise)", "value": "2ed8a1908451174ec53ab4936f419626c227e7a74feb284f5c3d56477bdfe3d4307f3f80629baace5a2a15373230be73", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075176, "uuid": "f14b733e-c089-4fbf-a536-fab4e7f78110", "value": "T1E436F111B3D581B6D4BF0638D87952669770BC088326D7AF9794BE697D33B808E22373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075176, "uuid": "f0607c7b-1a13-4e0d-a49f-620325e0916c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075176, "uuid": "4e292af0-79f7-4377-afff-a28e53b25a22", "value": "98304:wxwxd/6+6efPCqe9kNDqnS2wdYdstG1f2yrOnTJk3:wxCyefPCq18nlwnzyrOnNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075176, "uuid": "18813e0e-3b66-4bef-9706-3c53e1127a72", "value": 5298440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075176, "uuid": "cb76771c-e47d-4923-bf80-fff0f926b6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075176, "uuid": "5a7c6f37-cba5-434f-8614-e078cd07c097", "value": "8364ed9f0d16bb8496aef92b2c5e88de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34dff30-4d7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092216, "uuid": "db46ff98-7db4-4433-9efe-180e4df98ef3", "comment": "Malware payload (AgentTesla)", "value": "a2f36af9dff68b9a2f42c0d68bddb582", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092216, "uuid": "111f5795-6f53-47af-8fbb-797137168927", "comment": "Malware payload (AgentTesla)", "value": "1f81968fddb76ece185c982ff86bdd84ec7c1781000a590f9f2f3e6ca9c40027", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092216, "uuid": "28ab4de0-29fb-4c67-acbf-f605eafbdf06", "comment": "Malware payload (AgentTesla)", "value": "88d0040b0b09bf3c728317367f4da726a25f2be3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092216, "uuid": "8ee44637-5082-4ad6-801f-65557aff4794", "comment": "Malware payload (AgentTesla)", "value": "b242db6fd390acec844935f556e433c817fab3fbc24455289bb1c0c36c2a34139b1aa2ddf30d9d42258406bb6cccac67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092216, "uuid": "1c8246c5-d67f-4772-a6ea-10b84c713be0", "value": "T1F6442F037E44EB11D6683D37D2DF6D2813F2A0C70673AA1BAF48AE6526416436C7E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092216, "uuid": "6eb9d539-7b8f-48bc-90aa-c7c2994dc926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092216, "uuid": "c480a7f0-f909-418c-bdd0-7a1c1fde277d", "value": "3072:urTbUB1tZXoQP2Ppaw2UWxrhJDl7TmXieZtiOqB8OCtWf1:urX01treBnUrnl7TfB6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092216, "uuid": "1386269f-d989-48fa-b2fc-5535fb8acdac", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092216, "uuid": "31180e2c-d6c5-4543-b44e-c1b663cfba18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092216, "uuid": "001cb99a-96d9-4750-afef-59ca8f78f729", "value": "1f81968fddb76ece185c982ff86bdd84ec7c1781000a590f9f2f3e6ca9c40027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5f66c-4d60-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694078570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078570, "uuid": "71e5cc49-992e-461b-bdc8-3ca3be6eb28b", "comment": "Malware payload", "value": "c39103055ff76a21fe7af50f2157a2f8", "object_relation": "md5", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078570, "uuid": "9296f5d0-2c41-40ea-b944-a3e6c7dd1706", "comment": "Malware payload", "value": "1fc7dbbff1ea28f00d8c32de90c2559e4aa3629d26627094e92ff111e1092875", "object_relation": "sha256", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078570, "uuid": "00d0cc7f-45c1-40a9-a9f5-8223a5c7747a", "comment": "Malware payload", "value": "5c66dc8568ff3459a3265ee91597d3472a70ed79", "object_relation": "sha1", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078570, "uuid": "0d48a65c-cf2d-49b3-a6d4-b404aa440b69", "comment": "Malware payload", "value": "a5c11dae3c85977ed37b99e9ac8d73b8b8c52bd053944cc4bcba1ec996850fd60c5b534d053cc1df9a7498a8a3773fb1", "object_relation": "sha3-384", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078570, "uuid": "ea77a524-4c1c-4ee7-8c82-2db996cae784", "value": "T1906633A9863BD9C8CEDF58324D7E2B339A46087AF5F64169E4847C1C7944F09F248B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078570, "uuid": "9a3cb81c-2d8c-419b-83b5-87efa40d6c01", "value": "98304:03TXJv9FmSuggqk4GDfBmRJ6Ir1R5ZaLLcRtIIQx3q5OuWeGwPzP3bZghxPGtORv:CD7kSuggF4GDwRbDPaoY3YpBTbZZO4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694078570, "uuid": "0b0192fd-a255-489a-8db9-17a5fadf3044", "value": 6740806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694078570, "uuid": "b2bc5ed7-7d66-4a14-b2c3-790ba1fc5bd8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078570, "uuid": "a77d6f17-01f5-40ec-b225-e513a27e86d0", "value": "AnyDesk-x64_.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ca0b26-4d3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694064712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064712, "uuid": "13a02727-e6f8-49a0-b23f-e1990e734793", "comment": "Malware payload (AgentTesla)", "value": "7169468abd569f68286fe053da16226e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064712, "uuid": "c9d5ce14-b961-43f6-af3d-2b00197283ad", "comment": "Malware payload (AgentTesla)", "value": "1fe2be77e4073e5575b553ba1183fcb619c73639031b19e95b20c9b894bacbd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064712, "uuid": "fa7eeae6-ffef-4598-9d31-41349d037b0d", "comment": "Malware payload (AgentTesla)", "value": "8f0eec6c8e6e18ff1dc0d4b673eff60bb9921bb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064712, "uuid": "34fa3c5f-84ae-44ee-9575-7a3b8b7efdb0", "comment": "Malware payload (AgentTesla)", "value": "cce8061aee6b7c2b3060afdfa82c14b2ec876870d23f09b77e2c4649e3f63a694349be4ff8d0c588613f9071b8ca13cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064712, "uuid": "be347d0e-c0b6-4536-bbad-ce94e256a618", "value": "T1CEC4230228218FB1E22853F3114141D507FAEB08A166EF1D6EDAD2E85A31B1AD7177BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064712, "uuid": "3e532cc0-b6b0-4f6d-9830-cb352dd42aab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064712, "uuid": "b11db008-cdf9-416c-88cf-5494fc3d9653", "value": "12288:GlHdc7ijl7RZXxUgtptRXAI83d2wABq0rbWeCSa15fVsbR:GvgKFRfttpDXYaWJtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694064712, "uuid": "06f27ba3-e93d-4528-92ba-4f17ffc0872d", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694064712, "uuid": "7edbe3d9-b221-45fa-b3e5-e3a45323e31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064712, "uuid": "4b92b08a-6a52-4996-a164-f53aff9afbf5", "value": "SecuriteInfo.com.Win32.PWSX-gen.22093.1357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2364ec8-4d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694050580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050580, "uuid": "b845ddf3-df95-4364-a510-e5898f3deb96", "comment": "Malware payload (Amadey)", "value": "9d900ff8860c6236c7583294f2a0f1b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050580, "uuid": "5b089ea3-e802-4754-a576-b6723c0ae433", "comment": "Malware payload (Amadey)", "value": "216c7c86e5094d47134970bada71d93d8ecb9c5842380ecda5578aac3f4cacf4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050580, "uuid": "2996a830-64e3-4d5d-a599-68eefe9d679f", "comment": "Malware payload (Amadey)", "value": "39733c60f946dbd22d74a91824abce76bc35a532", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050580, "uuid": "8299aca7-49ab-465b-8b57-14d5785ac1cf", "comment": "Malware payload (Amadey)", "value": "df3fd7184cfc812269cd5c77027c75208a13479dd24d02ee455c88f2f581dc18d7867803ef85a22d3853ab873d56b9b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050580, "uuid": "3dc1deef-f3c8-4dcd-bc71-6060b23a76b2", "value": "T1CEE41252ABE85033D8B91B7048F313830E767CA299BC97FB3B86590E0D735856972727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050580, "uuid": "145c4c67-bb40-4c15-af9c-1e173733ec69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050580, "uuid": "7bd0c901-d1a6-47ad-bc72-9b7f4a3e0031", "value": "12288:sMrDy90ug00n/KS3sOILnSfoIOr5bufBhPfULHnT5UpL4TFdWFLfu:3yAn9sOI21S5biBhPMnT5UpQdWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694050580, "uuid": "a35334da-0bac-422e-9632-65e6d6166cef", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694050580, "uuid": "85b819c0-fa22-49de-94ab-44722cf1ac1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050580, "uuid": "6457c077-e66f-473c-bd59-797ea61ed3cb", "value": "216c7c86e5094d47134970bada71d93d8ecb9c5842380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42151cd7-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102683, "uuid": "0c149e17-19d5-4099-95aa-99b11dd3a2d6", "comment": "Malware payload (Mirai)", "value": "9667816065aeee41053ee20ae1ef285a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102683, "uuid": "a2bcdaf8-b370-485c-8dd5-bdea83aeeb1b", "comment": "Malware payload (Mirai)", "value": "21e399231286ecee19aad57cf80a9211b46e8eb8a32bff45b900a344e6f57f2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102683, "uuid": "0b40d246-ea93-4de3-b80c-584c88c3abef", "comment": "Malware payload (Mirai)", "value": "01b902aec7f1988d773df83f5feeb0ef1f2f04b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102683, "uuid": "bee5b21d-fa69-49c4-a1cf-18a0a1f02758", "comment": "Malware payload (Mirai)", "value": "d55d11cee27fc8a3700e3eec1ce2eb30030ac6146a02e00f7325cdd64d6c02b353dd2bfeae47bb2fee4861bd73f6e54e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102683, "uuid": "9e62c2f4-07f5-47c8-833c-893b7d5af025", "value": "T19BF31985FC909F22C6D6167BFF4E428D772A1768D3EE720389255F24378A89B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102683, "uuid": "9c276a2b-6f16-4096-8c0c-fa85043e331c", "value": "1536:/YlHdx/KL6OifL0fux7gGqH8D+I+awRU7amPowxFWAD1I6TXhv8aDfUOoYaiMIeh:E/UifLJ73QN27J4Ay69v8qFa/jcC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102683, "uuid": "247f1ae3-0c57-4f40-a9b8-73d729d55f39", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102683, "uuid": "8ad4bfef-9be6-4bcd-9048-3c5ebc77ab94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102683, "uuid": "c979bf7d-456d-4f8a-8c58-aa7a59afb334", "value": "9667816065aeee41053ee20ae1ef285a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa3de41-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094403, "uuid": "20dbeb3c-1a99-40d9-ac63-ce4230953fcb", "comment": "Malware payload (AgentTesla)", "value": "05342d48949b376ec9d3bb6da18f3650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094403, "uuid": "f6aca06a-a192-481f-ad6d-1e6b95306988", "comment": "Malware payload (AgentTesla)", "value": "22cbc7b139964a765479b35cdeecc33efb19425dfc34dc01b601fd31e125f39c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094403, "uuid": "c49bc7a8-a1cd-4330-8e19-285dd1af060d", "comment": "Malware payload (AgentTesla)", "value": "6c72ccb03aaac90e4f4a28030a938e5237926371", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094403, "uuid": "a34bd1ad-4632-463d-9cd1-47a68a6c4dd4", "comment": "Malware payload (AgentTesla)", "value": "c0279f74fd8934c2d10460f49b4fc4884d947d7f81ea4da73b12bf3174a2df03e48f74b7a547a5bb3b5eb4c9432c7651", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094403, "uuid": "8de1f5c7-b50c-47e2-9d36-599ee11af187", "value": "T11144FD137F48EB15D2583937D2DF686423F2A0CB1673D21B6F4CAEA52A452436C6E32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094403, "uuid": "5a2ecc28-ced7-4fa2-85de-fb6a49819bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094403, "uuid": "654f75a6-1d35-459f-bb15-ce69d29d6ae8", "value": "3072:h4RwOeKNlNmYHFo+c76FB8lqakz/kUhvzvlpP:h4eOeVL+yq7bhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094403, "uuid": "b65b4bc3-35fe-49d5-9248-77ae55f8d459", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094403, "uuid": "4cbf9017-58fd-4031-a9cf-45c0adef6bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094403, "uuid": "ab800bb7-5395-40fc-9f1b-39db8e96c0e5", "value": "22cbc7b139964a765479b35cdeecc33efb19425dfc34dc01b601fd31e125f39c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fd495e-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052391, "uuid": "511b6618-3648-4ce9-92a3-f9368739efa1", "comment": "Malware payload (Amadey)", "value": "edcadeb436a150e4fec2752cdc28f2fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052391, "uuid": "5998ff2e-0140-4d7c-9018-f75bea5f066b", "comment": "Malware payload (Amadey)", "value": "22ceeb8d945f2152e19581f559b47d942b9c3563f7ba4899db8a5ac5bb7dc276", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052391, "uuid": "4f0e9f10-97db-4758-a309-b5a1c879294f", "comment": "Malware payload (Amadey)", "value": "9a052b53cf89270fa9509843e793a0cea3e00a98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052391, "uuid": "fe128971-4e7e-45d9-9074-df776f758cfd", "comment": "Malware payload (Amadey)", "value": "3c540dd580c35929733d5960e68b6345a9503ea4863580fb0b2fdc3a35931252d514ad641859beda870196038e1b9c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052391, "uuid": "6048e42d-94fc-4a62-b5f3-e1ebc841a0d0", "value": "T1D824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052391, "uuid": "f846eeba-111c-4dfa-bfe9-b9d63ada0663", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052391, "uuid": "e3d44ab1-e484-40af-ba8e-57a0629cc411", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052391, "uuid": "76a8dfea-310e-4096-9fbe-57a9386793ba", "value": 225549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052391, "uuid": "1fb96fe1-7dc3-4946-ba50-627d85bce3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052391, "uuid": "b7675127-9726-4c24-b9f3-97ded77bf81c", "value": "edcadeb436a150e4fec2752cdc28f2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7cdb7a-4d65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694080934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080934, "uuid": "56c32ef9-19a8-4a57-b5be-a7ed6ec7ba96", "comment": "Malware payload", "value": "da87a0a2aba605908bf8b9a3f4377481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080934, "uuid": "350d086a-9e3e-43eb-b88d-227c5d66005b", "comment": "Malware payload", "value": "22ee7b8104599b47313195598ffc34aafd6a6552dcce0e7b3232ced3a90ac9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080934, "uuid": "cbbafe01-e3ea-410d-9a01-5ae16b5d5759", "comment": "Malware payload", "value": "5cac4ea0b3f0cc2d7c04655db12ad0443cbaa5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080934, "uuid": "ddc8b31e-c138-4a77-b5f2-2fee775154d3", "comment": "Malware payload", "value": "898ad52826a15a3cc51bcd6c2d62758f77b84540dfe951f388f48cbc39f6ccb2fe391ee2da75f890d328a195aecbeeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080934, "uuid": "0b1a7d2f-291f-40a0-bdcf-8efcf2d6c81f", "value": "T19A64F147B7E930F9E93A8336C8A015019735F8360A329F5F43A442AA5F372D19D7AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080934, "uuid": "870e6b8a-e7a1-49cc-9c4d-591be01768e9", "value": "4bc2037c060d678dc4f4604cd8d2e6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080934, "uuid": "9731214f-0402-4059-b929-b48e2bb46c81", "value": "6144:RBx7z3Bre16M01nguKBmmlbvx0zKGkl5EiCtuhNjtANJ4tDWhRaitlopYR:RnBreIfKNJVZotuhNZKxrYpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080934, "uuid": "a74b98ff-fcfd-40c6-a5b2-9c626e89ee52", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080934, "uuid": "8a92c0f3-5790-4b75-87b3-e201f4258c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080934, "uuid": "a9935076-5c6b-4b4a-a6ad-ca6d90c3b208", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e17bfc1-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075672, "uuid": "35937552-527c-43a6-9ff1-23ccb77105f3", "comment": "Malware payload (ConnectWise)", "value": "966b9c4d6943ba0478177b929310787d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075672, "uuid": "2f7b2701-7363-465d-a1da-2428ba1d1b48", "comment": "Malware payload (ConnectWise)", "value": "23742e1d6f202d288ebdb51b731a6ef647f00341693766f16f071ebaa89a09fc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075672, "uuid": "a256076e-73b2-4003-8f9a-7432fec1095a", "comment": "Malware payload (ConnectWise)", "value": "74621ccd8f9e75f84648694f1f8f50c18992f971", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075672, "uuid": "0ef0ef2d-88af-4931-98ca-d3d9b49c4042", "comment": "Malware payload (ConnectWise)", "value": "1dcef6c99fd9b89050992dbeef32f5b75908f91d4f51425fdc03a94163567174b70bc954f5a45334bd640f654f6a0065", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075672, "uuid": "fc55c8c8-c866-4864-a837-5f684bd8c913", "value": "T15F835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075672, "uuid": "4d05a9e7-2f97-4164-95e5-c7b3f29006c7", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075672, "uuid": "ae3098f5-70b5-4a39-9829-6fd98ebb608c", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3xk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075672, "uuid": "076f5baf-23d8-49ba-9fa3-e2e6d88fd632", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075672, "uuid": "59ea7225-19f1-4b51-a9b4-3e8bf2fa5d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075672, "uuid": "5b6cf7bf-d7b0-4bb7-a66b-4a13d87c5feb", "value": "966b9c4d6943ba0478177b929310787d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cd0215-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069249, "uuid": "004806ee-3c12-45c3-974f-18cc2d725dff", "comment": "Malware payload (AgentTesla)", "value": "00a535ba786b0b48f52d144cc681d71d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069249, "uuid": "4dae512d-b1dc-46ad-8de9-eceb63dc4c3a", "comment": "Malware payload (AgentTesla)", "value": "241417c3832ebbdc63cd1be559b4b4d33c2a0faf1c62457accfcaccd05b83528", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069249, "uuid": "cc485e0f-e6a5-4ee9-9259-dab3cc7362aa", "comment": "Malware payload (AgentTesla)", "value": "d1d9b9a258549fc5cf37dad4ba69f880cac52e48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069249, "uuid": "6ba576c0-c975-4987-bbc5-3d1135704534", "comment": "Malware payload (AgentTesla)", "value": "63d9cf9f17eb51a18a987db1299388b2e50911a797cc4be9851527aafdf90627fb4d5178587422a59bdaea2925158015", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069249, "uuid": "9d6f3f6b-a00d-4709-8c9c-559586a66b1f", "value": "T1EAF423BE17963DF5E6C1C87833743D5509129991BF8337AB6F1891FA3C1420A67AD30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069249, "uuid": "e76ea4ae-143c-4e40-befb-4562f1913d27", "value": "12288:c+hu3gt4eQASZ/4ZHfPGXCNlC2snmbMj3FYbqRWcoY396ZTWFpmsioo6jmj9l4vw:couQtl7eQFPGXaANngY3KGkc96hmNxvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069249, "uuid": "b2c99843-1945-4053-8eca-953f4a429b72", "value": 758013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069249, "uuid": "2ef0c274-7849-4cf7-a645-4e4f149af2ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069249, "uuid": "092f4f1f-8db5-4ca2-9c78-4e144f62b46a", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88307b89-4d5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694077031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077031, "uuid": "d5f46324-b994-4f9e-9039-5b0978d63918", "comment": "Malware payload (RedLineStealer)", "value": "365983e372e82bbbee0bb67edb1bcb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077031, "uuid": "866e9196-01c7-4d8c-816b-70ef0f157447", "comment": "Malware payload (RedLineStealer)", "value": "2430698bf0a0c32648e7e27dffbad606e82be3d88b03166b997fec2daeb7a3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077031, "uuid": "6779e665-d1fa-4102-9e12-62f2f4cfd3d5", "comment": "Malware payload (RedLineStealer)", "value": "76010d4e0a00e2f7d446372733b20bafff385f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077031, "uuid": "8f2ee72c-8e4d-4535-95d4-145adc3c35d4", "comment": "Malware payload (RedLineStealer)", "value": "81ece4efebf00ad9804369206733907fe84abb68803f8b6ddddc44aeb9e2de23212d521e4c7fa367e3edf72151d064e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077031, "uuid": "cacdd531-7c1c-4d7d-89c9-acaada63c213", "value": "T100E41296E6E49037F8F61BB058F74B871B36FDA25A38921A3345991A1CB36D03831737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077031, "uuid": "99fde9ab-851d-478d-a9d1-e9c3be3f19dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077031, "uuid": "f9fce278-1ad1-4a7f-a871-f937c2997f73", "value": "12288:EMrFy90HuVzFdgsQZny0A+MYK/lK5Rpa2ESEin5/+XpFR:Zy3QtYZK5+2ESEw5/+XpFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077031, "uuid": "4d42166a-fbe4-438c-90a7-d535503ab3c7", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077031, "uuid": "2944dc5b-5919-45fd-b5d9-385ce59e2d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077031, "uuid": "5b8b1ebe-e066-46f0-9600-9e6ab74ee54b", "value": "365983e372e82bbbee0bb67edb1bcb28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8451af4-4d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094801, "uuid": "2c568d3f-357f-4e14-8770-a6416e085639", "comment": "Malware payload (AgentTesla)", "value": "4735a8331f61db42f8f35b7de5399e4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094801, "uuid": "6f3c952e-557f-4711-a055-e4438eab4f1e", "comment": "Malware payload (AgentTesla)", "value": "243fb001fd54f84c1b6281c8c08ca19b6afdb34136b2b88ab67965ed5d323d9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094801, "uuid": "8a9d5333-6f34-4043-927b-6c5fedfa8d9f", "comment": "Malware payload (AgentTesla)", "value": "1d7c3bb7c76caf0de3fd5d7668dd8b0ae7c824c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094801, "uuid": "30677ece-0fe0-49ed-a484-63bca9563b0f", "comment": "Malware payload (AgentTesla)", "value": "cea700229d7692d3746a1a7d739aee78ce355eef6662b390b55dad0aa44db661a454b0c971ffe098372881f53195865e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094801, "uuid": "877829cc-7291-4447-af08-6e783cc0d042", "value": "T1C7340F17BE44EB15D6583D37C3DF6C2853F2A0C716738A0BAF48AEA529412436C6E36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094801, "uuid": "2afddfab-bbdc-4343-9bf0-eba8380cdba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094801, "uuid": "18cd558c-a813-4265-8cda-8f9c6ffc996f", "value": "6144:5/Wwbgw8/sGfIs3WzK8hsdJqnU7oTvqg44GvahEzt5k:NvuJe9hQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094801, "uuid": "0263ad60-7b1a-4d0c-8046-04fdaec8fdcd", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094801, "uuid": "22b3a82a-e41f-41ad-9d1d-46f60461d89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094801, "uuid": "ba5ec093-c832-4f9f-bc6b-076a96acf8b3", "value": "243fb001fd54f84c1b6281c8c08ca19b6afdb34136b2b88ab67965ed5d323d9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d85787-4d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694047576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047576, "uuid": "6776ee7a-35c8-45a4-8f2d-3436eeaa4c8a", "comment": "Malware payload (RedLineStealer)", "value": "14f517988d7fae7ffcd642528f53565e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047576, "uuid": "796ca425-016d-4538-acfd-c4d86d6bfb88", "comment": "Malware payload (RedLineStealer)", "value": "248e35747e30496893e4cc069a4c01b0b53db3c3bd0cb63b488c573669852cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047576, "uuid": "59de40ad-c317-4413-829e-c20ec36e150a", "comment": "Malware payload (RedLineStealer)", "value": "8d574fcce85b39b69b29796c3f5074d327ff9182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047576, "uuid": "0ad224cf-d4f3-44fc-b2c2-04006af35827", "comment": "Malware payload (RedLineStealer)", "value": "8bd419c72d3019f60ad11d2a8be183997f71cbbac2d88c9ec132cfb755914e6291e3d95343244600f1f2b3d2448df090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047576, "uuid": "4101c643-a008-4dde-8d0c-859455982df8", "value": "T1EBE41207F2E85132E9B01B3188F707970E3BBDB66D78972B26419D9E4C72784A631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047576, "uuid": "dec43f8b-d07e-4ac8-8326-efdc151d1a92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047576, "uuid": "216789b5-50ef-4f20-ad0f-a3148ef123a4", "value": "12288:kMrDy90+E7IMS/XM8h0xxgXY/QMY2T6Wuq3I43SimOfm80ccwxX9Lp+ez5RpNQ:vyfMQ0xmXY/F6Wuq3I4ClOtxNLpbdRpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694047576, "uuid": "61961d69-3be2-473d-81ac-e490f5e6ea19", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694047576, "uuid": "931ba454-ae82-42e9-8793-dcc69dcd9315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047576, "uuid": "13fc9932-69fb-486d-ac00-639682b16cb9", "value": "14f517988d7fae7ffcd642528f53565e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b73d2c-4d34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694059850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059850, "uuid": "ae2b47f0-5bfc-4a91-9ef5-34a4d91cb6b1", "comment": "Malware payload (AgentTesla)", "value": "da92b30ea43c5d56904b15e3651a8065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059850, "uuid": "eed9904a-4ec7-43d6-a853-d1b7b0890879", "comment": "Malware payload (AgentTesla)", "value": "24c957cdb333eb129fa5cde3ab365273ec1fb07e4a03e7bb92e7d8ae41301e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059850, "uuid": "e5e7bc7c-417d-44d8-bd41-20c459a1b429", "comment": "Malware payload (AgentTesla)", "value": "d4b0bfbdda68102226bb6c872b3e479d13d25485", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059850, "uuid": "077b41b7-d39b-4934-8bbf-0bbe51d28cc9", "comment": "Malware payload (AgentTesla)", "value": "555076f782d059300da54ce8b0e5662c9431fbe2725b430000aca4eeff0f284bcaac7b147c6f426d4867a45a0d76a01c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059850, "uuid": "df496f2c-0f5c-430b-b899-3ec71f2758d9", "value": "T1DF3564FC5CFC1136D9A0EE908ED9851BB1C0A57FF2896C1D97E20B650252A4AF88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059850, "uuid": "e3d4f747-dd39-48f0-8436-a8f7d8268383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059850, "uuid": "f3126d1d-6cd6-426f-a6f7-0888ce710f3d", "value": "12288:cIB4J0cHJvvPS0uunUovdChbGOnZGW1roP9ayB8KSgQCVH9lKS4z:ccE0cHJv3VIAghbFZGWJ0/DSeT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694059850, "uuid": "efced038-b051-4320-85f0-6b8593d64c0c", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694059850, "uuid": "d81e43e5-1f5c-497f-9fd1-7f122f9e265d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059850, "uuid": "e88c94a4-bfca-4b6d-b643-b66c7a1822fe", "value": "da92b30ea43c5d56904b15e3651a8065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e3f8de-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103783, "uuid": "0ad22c5b-7c0f-434c-bc7c-c098bdbdd202", "comment": "Malware payload", "value": "06f027391ae99300a15cae468088d57b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103783, "uuid": "9e28183d-3d44-47ed-88ff-9a725aa1151a", "comment": "Malware payload", "value": "25030f6733c26aecda429b5106c69c921d9d78b876b924f34ba9200358b1c496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103783, "uuid": "410bf6b4-25cd-4065-a235-f8812b4fe120", "comment": "Malware payload", "value": "2650e9981498f817352e54e482a16e6ed52e03ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103783, "uuid": "6049e89c-44a8-4814-904a-c673e385644b", "comment": "Malware payload", "value": "2a7a5b5a53ee4755948606034cfd5ede82eae37dc155040845a7610bc76653cb89ecab3370c9c02ebbd092d53d5ecb65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103783, "uuid": "188777a5-856c-487e-99cb-8bf2fb030045", "value": "T15B95338CA9B0DF2FC255587D02BAD12459A43FF04D254927B6AFAF079FB27E409624F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103783, "uuid": "a0c95f2c-ed82-433e-8caa-db7314a8694d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103783, "uuid": "3a3d7a59-5aff-4061-9ecb-33e3aef04d0e", "value": "49152:KtVha9KI9AkZPq7LwDzXajLOB4IvOkVJ+1CtmVW:iVQ9XykrwLOB4uOW8oUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103783, "uuid": "7f5c3fb6-e20f-4b1d-99cf-a3501bbdff2c", "value": 1894661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103783, "uuid": "faa1c8e4-5865-46d7-82f6-fb192bd1c064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103783, "uuid": "9590bfcd-55bd-42c4-bcf8-7d80663d90c6", "value": "06f027391ae99300a15cae468088d57b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ff4ffe-4dcd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694125669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125669, "uuid": "26344a19-ef96-4d58-b40e-79774e1b3a8d", "comment": "Malware payload (RedLineStealer)", "value": "acd150b1ac0232ecfed82acfb8ef8cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125669, "uuid": "dd1a506c-4af2-4a2d-8039-5c7ecffb1993", "comment": "Malware payload (RedLineStealer)", "value": "2514270a4173150a8643a3e00d91c154fa9471916e924767b19eb66a8236a7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125669, "uuid": "4a2bafc7-87e2-4348-bc4a-6c23e0428fef", "comment": "Malware payload (RedLineStealer)", "value": "93bb835f0a565b7736000a45a99a343a543e162d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125669, "uuid": "6b382650-5e17-4b69-96a3-3e0194eb7f22", "comment": "Malware payload (RedLineStealer)", "value": "a57cd1a3a3724bf1fa7fc94b6a56e704ed497682319eaeea9c747da4f3a6e642c48077f8b3cebc16a5c55bbb939f839c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125669, "uuid": "f731d398-9bfa-40c1-ad35-a125f8e13ea0", "value": "T187B4AE1292F1A873E51746318E6AC2F83A5EF9D04F6576EB33589AAF0D701F2C572708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125669, "uuid": "2d3d4f78-80a0-4d4c-a3f8-0800cb3dec1e", "value": "badfd3002a7785754765042ffe6b2bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125669, "uuid": "5e8518c0-36b8-4972-8cdd-5a50a24e9c34", "value": "12288:p7jmshzeswAbir4XdQ3c2qOx2JUgMfS7uu3Tt:p76shzesJb/XdQ3c2VkMYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694125669, "uuid": "cb991017-16c5-4ebb-b3d6-7720838886d4", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694125669, "uuid": "ab44a923-fe31-4251-941c-549f4a292d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125669, "uuid": "72012765-3711-40fc-8cb3-0c245802bcdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bc7e37-4d81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694093082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093082, "uuid": "61b86717-3737-4cd4-8f86-064e1a447786", "comment": "Malware payload (AgentTesla)", "value": "e7bc7eb1caff2058f727a39eff9247e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093082, "uuid": "c000ec45-0896-4150-8123-86e017aceba8", "comment": "Malware payload (AgentTesla)", "value": "25f455f936fb8836b363683c409396ce338b6a38b92da08ebe7b7442be710fb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093082, "uuid": "f568d02d-5df7-4d95-ad73-a68c697eb671", "comment": "Malware payload (AgentTesla)", "value": "3a5c5285262f0d10fff8756fc071b139da23e803", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093082, "uuid": "991207e0-85a5-4135-ab57-771b0bf70af0", "comment": "Malware payload (AgentTesla)", "value": "7417e16d1354bee4e3fb6a98e5b16583879578c3975dc394ad62c4c60b2377ca30ab5b093b72435aad807840c03cb34f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093082, "uuid": "c6033c47-be7f-4224-aa88-6adc3f24e69b", "value": "T1A9A4F813BE44DB11D2987D3BC2DF6D1803B1ADC34633920BAF48BA6269716532D6E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093082, "uuid": "eb0e4e73-82af-419b-bfe9-5ab210b1a416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093082, "uuid": "b2772d10-6b14-4cb3-abc0-ce58536b7cef", "value": "12288:iDuSNJA7yfJo1mJxRHHE6mRsc9gC8NLhPtD6IA1:iDuSNJA7yfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093082, "uuid": "5cc39a52-76c6-427b-8015-eccfafe32928", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093082, "uuid": "ebaa2038-f1db-47b7-b682-d1ba5af75bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093082, "uuid": "353a750b-6b4d-431b-a366-f759f956b004", "value": "25f455f936fb8836b363683c409396ce338b6a38b92da08ebe7b7442be710fb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939368d9-4db5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694115275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115275, "uuid": "46809213-3e87-42d2-beda-acad9fd9164c", "comment": "Malware payload", "value": "97fa4e4b60159e4e3b600268dba98365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115275, "uuid": "c8a2dbeb-0b3b-4197-abe0-0be0edc6ac10", "comment": "Malware payload", "value": "26a6bd047ac89a2cb4402e59d94504b548c53208d94250bdd04dc6363008c24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115275, "uuid": "9d29b52e-c3b1-447a-9b92-9d1b94d4331c", "comment": "Malware payload", "value": "6e634adfd68fa5cc2f2718621b8a73af8d3659a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115275, "uuid": "4f204a4c-de73-4e1c-a824-a8e175648396", "comment": "Malware payload", "value": "091aceb47d2ca388b930130ea11569ab788033f49dda929b03d7ed8b203bd3edb1d1b5c7d7f1c1f326e4dbd3d15a7af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115275, "uuid": "e50fa6af-4cf8-4af1-8f04-0b7d70ef9fbd", "value": "T1E216187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115275, "uuid": "3e31058c-7ee8-45cf-bd7d-eb389fe3f96d", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115275, "uuid": "23a4b6bc-1f4a-4659-93fa-6329afdd6242", "value": "49152:Qgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWYjXNO:ea71fIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694115275, "uuid": "bb493497-5cd7-4e46-a9c6-e375329c0073", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694115275, "uuid": "50a36562-9510-4e8d-8cc2-849591621343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115275, "uuid": "2a24ae63-67a7-4606-8e67-13313d4660ad", "value": "SecuriteInfo.com.Trojan.Packed2.45650.14470.20623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c43f7f9-4d22-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052127, "uuid": "d2fa5bc7-d2a5-4517-9495-4b74c107ef09", "comment": "Malware payload (Amadey)", "value": "086703e4d154c810c50a4565e731bb3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052127, "uuid": "dd98eb59-84e6-4ab5-84f8-43857758f356", "comment": "Malware payload (Amadey)", "value": "26d01bc93befccb8549307f719b2ce694249e714d6abf711dbe544171dadbf0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052127, "uuid": "7074bb37-6f94-4999-9826-8cc96597f243", "comment": "Malware payload (Amadey)", "value": "acec783d2e0eb5afba7393dd8d62a2dc5e9c8a05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052127, "uuid": "10588f7d-a9c1-48e2-9e25-1e2f5ea334b2", "comment": "Malware payload (Amadey)", "value": "eac80a226b2059bad28e868d4d1aed1cd5423848a6ab4aed1dad3c27afa620b838492d46afe6391468ecc7c9c4c9c847", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052127, "uuid": "8fe094fd-4ebe-4638-a024-e565b01bde0e", "value": "T1D944CF22B7D1C0B2F2A752745AB2C7B05A3BB8B25B7065CF67D4167E1E706C08E7431A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052127, "uuid": "be90d06f-d4f5-4423-b8ca-50d6bf5414fb", "value": "d17013689e887b16bffa7c0e14d6a4e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052127, "uuid": "100121a6-1a8c-471f-8e26-5137c9295bb1", "value": "6144:iJwnALfruq7dHhfoHZky4V+KR+9C2YtKb:8nLSq5Bfeb9WtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052127, "uuid": "6f7e1984-2f0f-49dd-acbd-d339363fd5b8", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052127, "uuid": "2eddd0c4-8f19-40b5-8c5e-acd90e2b23a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052127, "uuid": "6b284d5f-64f9-43fe-b0db-6c3f2bbfb81e", "value": "086703e4d154c810c50a4565e731bb3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc3d984-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127536, "uuid": "8a0912d4-995b-4726-823c-cbbd89b2570a", "comment": "Malware payload", "value": "0f6bc0b3196261e0f0cc2abddd6d70a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127536, "uuid": "091d6713-9d64-48d6-8706-2cbfdfb71d18", "comment": "Malware payload", "value": "26d0544162da295f0b8c413f26c514cbee72a6bcd1af08c796fe936b04cf0910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127536, "uuid": "ee3e2e3e-61c0-4227-99a7-50b7597906f3", "comment": "Malware payload", "value": "45ec8158269e494c30392b895aa06ae34ff88aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127536, "uuid": "2839103d-87d6-4504-9c71-091d3f8d03c6", "comment": "Malware payload", "value": "0c9dc4877777f745ff8860fe995b27fcf5ba76baddc495c1de6d4f6bcee6dcb394f2ba724d806a1c212ecc9c3c98ab5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127536, "uuid": "705a0abc-9902-4de9-932f-e9322d3bb176", "value": "T18D44AE5076D440B1DE974137D6E1EBB106BDFB315E62AE8B138C573ACED0A80A3316E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127536, "uuid": "ea7e251a-5d30-4949-a47a-d83181d7269a", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127536, "uuid": "c93ebcb8-0152-40cb-95d4-fa7f7ec18892", "value": "6144:9g6HW09nd1kCh2EonESvk2+Y5eYKsusmTfhnjtZ:9xXHkCk+YJKfFZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127536, "uuid": "341d2ed9-4d69-4186-bcd0-96c78d9c1518", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127536, "uuid": "996ae74d-ed4d-4366-b35c-3e3c94dd16de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127536, "uuid": "5fb6b35e-277f-4402-9d4f-959318588324", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39df8d83-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096656, "uuid": "43a0b6fa-2658-48bd-9034-f2b18502efda", "comment": "Malware payload", "value": "78724fd5de931eb917b1b7780ffe8b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096656, "uuid": "f37022ae-6164-41db-a348-111eb18e92f7", "comment": "Malware payload", "value": "27026282d2170cd2dc30551e302b4615e8a66ba719333fd1b02d2259603bacc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096656, "uuid": "79c15bb2-4a6e-4263-8a6b-0029e918aa29", "comment": "Malware payload", "value": "35c07e6a8c691074391d777542f1456e6bf77779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096656, "uuid": "9c98fbf2-062f-40cc-908d-4af3d9913c8a", "comment": "Malware payload", "value": "f6e13a5af8443ba9bb26403a80f45e7bad8b5a32c65e2e795a79f198cd717acec538855bd28f232aa365aec4609741df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096656, "uuid": "853c755d-1707-4141-a404-666aa4e55f02", "value": "T17226221396D17C68EA259BF29F1FC9F8360EF5614E197B6D33189E1B00721B2D223792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096656, "uuid": "a4d75b3c-ad2d-457d-b8ed-ee6f23234bd3", "value": "0d5ccc78ff50fbd2fc0370addad4c1f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096656, "uuid": "17b24415-b1e4-4a36-b267-429d61716315", "value": "98304:EjLD1Sdt60qyZV8efKmDIGEFR7OPqtBTPj6xU5fBHLHs32A:iS7OefKkI/OStdWq3HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096656, "uuid": "8f6dd357-78ed-4e9a-8aef-26ac597c1670", "value": 4482440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096656, "uuid": "1b7a29cb-97dc-46ef-86aa-51a745bf9321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096656, "uuid": "a757c228-8dd2-442a-9d10-d242a450a2cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a1e240-4d52-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694072792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072792, "uuid": "13a1bd12-32e7-4078-8af9-880750510fe6", "comment": "Malware payload (Amadey)", "value": "b2b75047d8ba0a4a480df347e3e6d700", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072792, "uuid": "e0217647-ad6d-43e0-88ec-00e8710813ab", "comment": "Malware payload (Amadey)", "value": "276bf78f70e16c98068a8d81a805bf26082710f6312e0e426fd835c468a2d9c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072792, "uuid": "600128ea-cfff-4a59-b03f-34093afb23e3", "comment": "Malware payload (Amadey)", "value": "08d91c40e1c13fd90094caf277d1fa2ce18917d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072792, "uuid": "08edb9de-140a-4303-af9a-61335adc27d7", "comment": "Malware payload (Amadey)", "value": "9887a9eaca2c0084755f7d403ee85ae7d0d8f3d6c7bee92ea0d5cb98d2ea95ad660a2fcf0c2e37c346cc10663ed6adc0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072792, "uuid": "e033122c-2162-4b09-b389-63f4f2dc47e7", "value": "T16F24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072792, "uuid": "820d69ce-c811-4fd1-9585-510aab1eea52", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072792, "uuid": "aceff5a5-3e54-4081-a847-1eec56e49c5a", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694072792, "uuid": "ca3dfcc7-62a1-4c38-a02d-7d71419bb174", "value": 225893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694072792, "uuid": "0ffd30c9-b11b-466f-bfda-54b1dbef1305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072792, "uuid": "00e34d6d-4f21-4e96-8542-b5a888a23827", "value": "b2b75047d8ba0a4a480df347e3e6d700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5b6b42-4dbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694119615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119615, "uuid": "ae38dccd-8c45-4225-81ca-3874ec665021", "comment": "Malware payload", "value": "40f236182c70a8af8d8d2701c47603dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119615, "uuid": "e82ce34a-21a9-4bf8-bb43-bbd676cd473a", "comment": "Malware payload", "value": "27f599038343d5433f51dcff77ecf7f72256b21829e96b9ce71a7241466f0a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119615, "uuid": "582bbf11-7c44-4e55-a32f-b199576a30ab", "comment": "Malware payload", "value": "895a20e58bdc3552bd130f3ae314b342f358ea4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119615, "uuid": "7bfe617a-02ec-403d-bea8-e4e23dd37f4f", "comment": "Malware payload", "value": "cfe6c7a963edf6df64fc26456ff80e155fee62528ed76bcdddeb69d7be241a3323a026b23e2f175f8ff6df53ae32d6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119615, "uuid": "4d1b4414-c0c8-49b2-92b9-b108b234a297", "value": "T1A4863341A3A818EAF845D53EC5CA851AC773395527F0D58B0B9C87B60F2B1AA4C3BF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119615, "uuid": "7c45062a-06b2-4ceb-9aa6-d1330a822579", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119615, "uuid": "3a941dfe-fe14-4119-954f-2ee7f5132899", "value": "196608:BsY2OshoKMuIkhVastRL5Di3tnSEM9SPJc:mY2OshouIkPftRL540Joc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119615, "uuid": "3705e652-9a0b-4489-a3ff-2d5e18731914", "value": 8580913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119615, "uuid": "1687dbea-1b11-4e56-86c7-1f5309c1adff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119615, "uuid": "110a1ad2-6ef9-4583-a5a9-6f570b113231", "value": "VIRUS_stub_ro_crasher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36e3a16-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694075493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075493, "uuid": "1f6a4a9c-9a80-42b3-b092-7c064bef8fe1", "comment": "Malware payload (Amadey)", "value": "206ce01a6ede78ea77614fd02ec7d6f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075493, "uuid": "9aa6b839-4ba7-4c7f-ab67-01d6aa1e64ed", "comment": "Malware payload (Amadey)", "value": "280f000ce7ec1fde5eae399f2479ff1dc2ce938192959a646e025f816e160097", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075493, "uuid": "0412ca56-7342-4877-bf3d-4dcac297c085", "comment": "Malware payload (Amadey)", "value": "63fe2ba79bed348fb6f9b2d6d6e97f289690a536", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075493, "uuid": "ce7d07e5-b576-4fa3-aeba-dc744df9e2fa", "comment": "Malware payload (Amadey)", "value": "2ee2ed38ad6ec8eddcf9f9a5a23b3131cbd42d889713db0a2139ff5c55952d1aeaafaad63bf4bc528a93429405173ed5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075493, "uuid": "8a6548c0-fe17-4abe-83e8-5beb24379123", "value": "T13E24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075493, "uuid": "196ba0fe-1e34-4ecd-b911-136800871821", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075493, "uuid": "217ff57b-c7fe-488c-99e3-9626fd97d543", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075493, "uuid": "9df25966-67ea-41bc-b97e-ec9f032b739c", "value": 225916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075493, "uuid": "9ef84cf2-d877-4609-8c00-e626f1872f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075493, "uuid": "6fa2600d-c865-409d-af26-0f23d327faa1", "value": "206ce01a6ede78ea77614fd02ec7d6f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc3ee6e-4d61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079375, "uuid": "1fb25d77-b9f3-4a7c-b7e1-012d1381a99f", "comment": "Malware payload (Mirai)", "value": "5f586c18e200e1fd4f95309c94b53372", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079375, "uuid": "2dee9be7-d24d-4f11-adb7-7285e187cb49", "comment": "Malware payload (Mirai)", "value": "2828c47518411b5881a5830adf07641d5ea714d26a978c6692cd0ea6aaea915c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079375, "uuid": "477230c5-cee9-4bb0-bbb4-38f0421eb62f", "comment": "Malware payload (Mirai)", "value": "4c932ae7214ff9654348d94e0b7eb8957ace112a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079375, "uuid": "1dedc1da-dad8-4849-b221-5982350186b9", "comment": "Malware payload (Mirai)", "value": "fb6fa4a9427eca50257b17c715415d40f35d4482fc73bad331a7db2326ba0fabb3f1980e1b2a130942b05b8a60d82750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079375, "uuid": "c5fe9868-f3df-442e-80d3-8f4910d56525", "value": "T11E539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079375, "uuid": "7fc35d50-b917-425b-88ac-df9189fcacc5", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079375, "uuid": "ab8bdba1-b60f-4d25-8759-c2cbccbc9c8e", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079375, "uuid": "32b1c0b7-ba3c-4748-b00b-0367f0de475c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079375, "uuid": "30f23f25-1504-40b3-8442-ed3d88c70a5a", "value": "5f586c18e200e1fd4f95309c94b53372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29083b1-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085262, "uuid": "0a165795-b793-4268-b987-5ed1057abba6", "comment": "Malware payload", "value": "20c6099e0a5c3c37eb3c60c07989777b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085262, "uuid": "5e97e2c1-f156-49ab-8480-c63d3f3fe83f", "comment": "Malware payload", "value": "291308c749381a449a9e4cbfae06ac98f8e17d9d014e34fbaa18164498b00eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085262, "uuid": "23291363-9a03-4f7d-8b7f-0706167266e1", "comment": "Malware payload", "value": "76e901a9cbfa18c64dfef08b3921642e89ad705e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085262, "uuid": "ab923644-4fbb-4437-b39e-350ffa561fef", "comment": "Malware payload", "value": "f5ba6286dcf608bd509279393e0d6b7c9169efce6d90f3e8d5e5239d625798b55e3beb2b270a615787fdc5c6b239e843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085262, "uuid": "583854f8-32ef-449a-889b-214cbb2ddc35", "value": "T1CA74020FE941BFB7DE1419F98C0096FC1DE83F30DD29E19EBE5C0B0E27A52994968A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085262, "uuid": "6fb125da-1c16-4247-bb81-0b9e6b607ef0", "value": "5662cfcdfd9da29cb429e7528d5af81e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085262, "uuid": "f829fe24-d9dd-4458-96bd-872ff12060f9", "value": "6144:g731bdBaB1Ve8eAt0jPnHNNjSwuerdqsYQKuy+ube4aZoPe4Te1m7Sbi1HMTraYp:S1b4VlX8tNjS+yGn9ZGNSbRrp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085262, "uuid": "186a06e8-89e6-4a0c-a12c-3e5e143dcccc", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085262, "uuid": "517d1d3b-1902-4460-8f84-f639e560b4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085262, "uuid": "16b2bb37-f3bd-45d4-8074-f2b8d5cf9283", "value": "Virus.Infector.ATA_virussign.com_20c6099e0a5c3c37eb3c60c07989777b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4711cce-4d9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694104593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104593, "uuid": "5c672069-b84d-40bd-86a4-fe48e1f3c430", "comment": "Malware payload", "value": "5b3395b7b65eb5fd004dba3d67b52a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104593, "uuid": "0c874181-e44d-4a48-bc55-629095c6195b", "comment": "Malware payload", "value": "293c0fc9bd878d8b69dd2ed93a24112a73504baea53d08a0f6eac98b2507b6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104593, "uuid": "c57d9f2a-671d-4bfa-807e-83c2e9534c6b", "comment": "Malware payload", "value": "e87a38ff045613f9b28b077ca4f53bfa6145bf1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104593, "uuid": "2692917c-902d-48b7-b432-9143ae74fb14", "comment": "Malware payload", "value": "c4aa11db3e3ba51f713b3f49f9fbb1b29e3ba3554f9b1791a1acaf6d66e5008eddf395bf853618290c8a95413807003c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104593, "uuid": "42e9c17e-0b83-4ff7-a89e-21b1b6995238", "value": "T1EF16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104593, "uuid": "1300075e-7198-4fef-a1c5-772a0aba9250", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104593, "uuid": "8b37e1be-d537-4f44-9bf6-53a23651a66d", "value": "49152:egh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcW1jXNO:0a71f1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104593, "uuid": "969b7d00-6a23-4272-a7c2-2f81c787e074", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104593, "uuid": "eba3817c-64c5-410b-9030-14de6ea8f538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104593, "uuid": "683ad41d-44f7-471a-a5c5-8a1f6901fdb0", "value": "SecuriteInfo.com.Trojan.Packed2.45650.19018.13615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf67e203-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694086599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086599, "uuid": "c2e85343-570e-4869-9a68-dcb64c7a5ee8", "comment": "Malware payload (Amadey)", "value": "f55acf1e6e01660d0ae111f642a98e38", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086599, "uuid": "ccdd399d-c6f1-4c34-8784-8a4fecaeb027", "comment": "Malware payload (Amadey)", "value": "29d96bb916c6a4561380ee10d66fa59da946925bf013899e3bf27209bcc88657", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086599, "uuid": "19aba0c1-0b80-46c9-83b5-061fe7261aad", "comment": "Malware payload (Amadey)", "value": "2da48fd7206192722b2a8358fd57a1d0c7222e77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086599, "uuid": "564607f5-dc57-48f5-923d-3853378f206f", "comment": "Malware payload (Amadey)", "value": "b9a67599d7af3bc6a9ceaef42c05cab9b1dc65a6b87d22392b4fa8425fe2162304649a78b0116327c97e2409cea01305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086599, "uuid": "3edce8ff-748e-4fbc-ae1e-191f84a9a49c", "value": "T14A24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086599, "uuid": "4b32afcc-c340-466c-bf2f-ec8695a52367", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086599, "uuid": "7cc6bd80-d606-4a90-86df-0c85da7d77a7", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086599, "uuid": "0d515f93-0dad-4e8e-b007-2f71c5832acb", "value": 226124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086599, "uuid": "40a72795-cfe4-4399-a59f-64780560d78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086599, "uuid": "9f75cc93-29dd-4127-9df4-835b308b84d5", "value": "f55acf1e6e01660d0ae111f642a98e38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5255e1b3-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075652, "uuid": "8dd71328-e043-4e76-82ea-ef32a5d222c8", "comment": "Malware payload (ConnectWise)", "value": "321a8d8da976da2cdb1a922c1d4ec7eb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075652, "uuid": "cdc3e9e2-92e2-4055-8d1b-57dee6410797", "comment": "Malware payload (ConnectWise)", "value": "2a36399443df8bc85e469ef70e476971edc64f1b437fce06bc1fe03dc7166920", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075652, "uuid": "1e97602a-05cc-4898-9c7f-fc09fa224568", "comment": "Malware payload (ConnectWise)", "value": "62aaf1bf15a077add96c2a3bd394041c5910bd6b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075652, "uuid": "008938b9-55c3-428e-a90d-1a5e9ab87457", "comment": "Malware payload (ConnectWise)", "value": "7c2b41751ec50b2f09df6b8606ed999a5556ca19634672408a51c459ec07c48f35f6611a11dab316ba39a01acc82e5d5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075652, "uuid": "e60e6319-d3eb-42fb-807d-ed71f14a1a32", "value": "T12C835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075652, "uuid": "f19bdb27-25ff-4c51-819d-58ff89e05a59", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075652, "uuid": "0e687f63-5778-4bd7-bad3-623bc65b6ce5", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3nk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075652, "uuid": "2f1a1458-bd8e-43eb-adbd-22b4fa8d9225", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075652, "uuid": "13de82ad-8947-4f10-ab29-54f03c1cbe2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075652, "uuid": "5a29d951-066a-4cef-be5c-941b32d00d71", "value": "321a8d8da976da2cdb1a922c1d4ec7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77798da-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075795, "uuid": "3be407da-9268-418e-b802-3df2e39b8c71", "comment": "Malware payload (ConnectWise)", "value": "fb97236a02d3670f4811e9a434fdc784", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075795, "uuid": "88dbfec8-3405-41d4-a121-c54d066b44ba", "comment": "Malware payload (ConnectWise)", "value": "2b76683da2de1369883e8d22a527ed7e6d9fe29e3dd597e8463c8153bc028547", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075795, "uuid": "ec28a899-74b5-4f48-b334-d4fa63003ca5", "comment": "Malware payload (ConnectWise)", "value": "755f0984cd66a3171f1f893d267463f6fa352298", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075795, "uuid": "1b5456ca-0b99-43e2-a331-91aeb5cfbb23", "comment": "Malware payload (ConnectWise)", "value": "cab02631045ed57925860a9f5616f0fa8f73c605673f940252c65a2545a9646be77a8e252748cf37e41199c3c442fa72", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075795, "uuid": "02654d49-aefd-4eef-8ce3-2bf81acbd602", "value": "T104835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075795, "uuid": "f8ac7547-eebc-45ab-9626-70a047f910e0", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075795, "uuid": "423e7721-ac9e-4181-bbdd-f0c695079c3f", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx37k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx37k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075795, "uuid": "713fb5f5-677d-4ba0-be20-9cbcf6b19892", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075795, "uuid": "2ceda0dc-abab-4e56-ab74-2c3750e2669a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075795, "uuid": "1c7c6194-c537-4295-9051-a3c493b84426", "value": "fb97236a02d3670f4811e9a434fdc784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aefdb9a-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075747, "uuid": "1518fcc3-1a89-4b35-bd04-77a5f75d3081", "comment": "Malware payload (ConnectWise)", "value": "c7f478f5e86424d31dfa28c354975160", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075747, "uuid": "0860ae17-911d-410c-84a8-373894d3cac4", "comment": "Malware payload (ConnectWise)", "value": "2c1a77a9178b782aba1bc755fddc5aa68eb7c21ff00d184c25a4aba92f366ea8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075747, "uuid": "a9d245c6-b591-48a1-b518-cb60c4540be1", "comment": "Malware payload (ConnectWise)", "value": "16236921a3a30523abccdc463c5e7cf0c6898ff9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075747, "uuid": "e07a622c-0107-469f-904d-9655647e0cbd", "comment": "Malware payload (ConnectWise)", "value": "6de646251a33f65bc0006995d65419c8d615bcfde6b5a3ec7e23bd1a2153c2828622a5bb3bc12c73187c9427e1440279", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075747, "uuid": "a55280b7-8608-4fb4-b40f-91939385c4c4", "value": "T10D836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075747, "uuid": "e8030723-d2e5-4eda-8d8d-27ceb3131f57", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075747, "uuid": "ba83d296-6832-4e0a-8c31-a763979c210a", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3yk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075747, "uuid": "36c5894a-509a-4354-adcb-3cfe17c1503a", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075747, "uuid": "73c4d524-5862-426b-90dc-41f15a32304c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075747, "uuid": "0d58ca1a-99e2-4d4c-9665-00b6a07581ee", "value": "c7f478f5e86424d31dfa28c354975160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56c6d7f-4d63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694080113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080113, "uuid": "96191ae2-cd33-40d9-b045-edcb614b6ed9", "comment": "Malware payload (Formbook)", "value": "236c47b4dfecef8a18a18b9b4829221c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080113, "uuid": "fea258c0-04f4-4392-8f82-9393a9eb15a6", "comment": "Malware payload (Formbook)", "value": "2c957c2aba9dfb0c39754bc5c690b50370fe3cae0e80c28f778e2d6415ee4508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080113, "uuid": "2df99eea-8e73-45e0-891a-4ef7b26de712", "comment": "Malware payload (Formbook)", "value": "93d58cc2f7ea8eb8a81c9e2208b9cd8c0d875bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080113, "uuid": "f1620a93-3493-438f-a881-dd998fd4fbf5", "comment": "Malware payload (Formbook)", "value": "6cbf24ffb91868ec537e56a7ec430e8b41d6f390b98888f2ecf2842c71a8c998a37d622d61b196fa6719763e25de8170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080113, "uuid": "8a9bc53f-d277-4191-98b3-e1f142b333b2", "value": "T189551202BEC0D9B2D06658324A3597216A3DBD301F64DEDFA3D41A6DDA315C1E731BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080113, "uuid": "e8cdfab3-cc8b-4f4e-98f8-2359c93e7716", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080113, "uuid": "e72bcc30-02b9-441e-9ee3-94de32f110cc", "value": "24576:vTbBv5rUPL6WyutZfb8Z2uzCwtqO7syeVKN/5ivrWvM:ZBwWsZILdtZgy0KN/5ivriM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080113, "uuid": "0b4ce863-978a-4dad-8809-ed3dc1072a7e", "value": 1288040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080113, "uuid": "7bb3c7fa-ff0b-47b9-a777-5dde4f9af4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080113, "uuid": "41e34dc1-67ea-4fc4-915b-352003dd5228", "value": "2c957c2aba9dfb0c39754bc5c690b50370fe3cae0e80c28f778e2d6415ee4508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a76471-4d5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694077053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077053, "uuid": "44e5b616-ba7f-4476-b3f2-451e1ef66e4f", "comment": "Malware payload (RedLineStealer)", "value": "af768506c38fd89459f61c82411f9f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077053, "uuid": "400a1d1c-806c-492b-9a84-7335e9dd02b9", "comment": "Malware payload (RedLineStealer)", "value": "2cb475427011494ee99991cb57f6b11f3b7cba03652475d008d7fce31ed3e5be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077053, "uuid": "d8b0a9bc-3775-45f8-a447-b7b31f0d7c4c", "comment": "Malware payload (RedLineStealer)", "value": "7f4a911d16297f4879909fdff346e2bb11ad7bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077053, "uuid": "3be3bd25-bfce-4d8e-b325-546af829f980", "comment": "Malware payload (RedLineStealer)", "value": "007b01775a76e9184a01af2005ed78c3cb28cf0f7c115c63a02e966ea8959b22134cdb673daddf669ffdb7fd9fb84484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077053, "uuid": "505d1f64-30dd-4fac-98f6-ee6eae5cca3a", "value": "T1C0645C5131F1815BFBFD8F7241584BAC426AE4A57E5EC8EB21C808E685532C3427EB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077053, "uuid": "810924fe-289c-48e8-b43e-ab20603380b2", "value": "9a9c7c06d9220705f831820550e9df58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077053, "uuid": "9db0a768-2af8-43a0-8c93-a829d54f215e", "value": "3072:3khUlkQq8hQUESrqRHfyOPW+9TOvTztPacu0MvrH0/ZTBS+GrCgHH9T7poTrd7mz:3BkN2rqNPgBvhT4nJCxr+RAypBowZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077053, "uuid": "111894e0-cca7-4672-bd68-63e3ef9c3a31", "value": 309112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077053, "uuid": "6c7e0f5d-ce00-4048-abe6-8b896e57b0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077053, "uuid": "892baf43-a3d4-4c53-84be-658ebd1bbdd7", "value": "af768506c38fd89459f61c82411f9f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bcb600-4d86-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095230, "uuid": "9e32f6fe-c4e6-4ad3-9b22-4ad496b6b230", "comment": "Malware payload", "value": "caec2b11c7e174a81015820adc7ca472", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095230, "uuid": "81c77b96-0efc-4d0c-991f-a15f9ac22d31", "comment": "Malware payload", "value": "2cee7bb8d77c69af20d18d7ae65d18066ba6f9e851b093aba6bee6f17c8680eb", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095230, "uuid": "8528db1f-4823-4c04-a028-9bee0d173264", "comment": "Malware payload", "value": "f5b82a59311f3c992dc4ca068e3220cd49502fa0", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095230, "uuid": "0c14aae3-1523-4dfc-952a-3d6b4e002f4f", "comment": "Malware payload", "value": "d64df362f01ed0ed300809c94453c86b629bc8e53895f1a985309efb5d5d9c2a5f732f6f2e39c8d6b915903dc24ef9b8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095230, "uuid": "0c822147-1abb-49a4-b03f-53e931d31a9d", "value": "T14A1187F65B2E5012C5B5CB821D4B928ECF6081A298C40A14F8FE4E75DF39166A35EACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095230, "uuid": "f86cc2bb-4f8f-4079-9509-92945b6fc92c", "value": "24:DOVtyCiREEqsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiqsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095230, "uuid": "2ae02a2c-b1e7-4172-a148-38a553c6e255", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095230, "uuid": "7b593807-dfdc-4a05-8a10-1d2a539b0a1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095230, "uuid": "62bedb4d-765f-45f3-b9a6-fbe6b222528a", "value": "4j9qeGVr.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e90c3f-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103248, "uuid": "1677a6ac-5201-4234-a52c-dc0ab96411da", "comment": "Malware payload", "value": "599494a642bca2704d66594535918679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103248, "uuid": "9d1221dd-0357-490b-bfaa-202de8039448", "comment": "Malware payload", "value": "2d560f0a3391f0f773ac8fb17d4fc78a75c8e5db4fc1256d9a1a8ff8115efd5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103248, "uuid": "572e897e-f285-4087-8774-ffa7601670ae", "comment": "Malware payload", "value": "43017b77c692a8f2f82d3cb0bbf1fc4e02d5f20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103248, "uuid": "0f8628ac-cc30-404a-be8d-d24c9c245138", "comment": "Malware payload", "value": "2a41628ec42c08de9635f189271680f0a52ffa3fc45f56f06b4d786f039a890afccaabcb8a37b48d1e7a3152c7b4df39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103248, "uuid": "95d112a0-0081-4706-9239-af833e7eb74d", "value": "T17DA4B543BA468BF1EA895BBEC18B500417B4DA9323ABDB0E758E23951C43F76DD25307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103248, "uuid": "e2fe6a30-a523-4592-ba73-a6e28dcbe395", "value": "12288:mImiaZgI2Mru1gPaRIIgSnozhiDYInMT:msaZH2BqPaR3gRzhEYInMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103248, "uuid": "fc769ed0-9baa-45be-ad88-cb529fa8daca", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103248, "uuid": "61b53810-f35e-4e07-9feb-25521f3391a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103248, "uuid": "1f828302-cca0-43e5-b222-6f5f0b87c7c4", "value": "E-DEKONT_001 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c63d043-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122135, "uuid": "24e0e56c-f010-43a4-982e-fb446cb251f7", "comment": "Malware payload (Mirai)", "value": "4c0711f5e5b2b815441babcb8b446e50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122135, "uuid": "8853d64b-2fcd-46d5-9bba-e3bb6bb263f3", "comment": "Malware payload (Mirai)", "value": "2e1f165b39f4bf2f4b2c47fa3e0b9100cf340593807023debdf2b39ef8897514", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122135, "uuid": "121f4a38-9f26-43b9-b52c-3d41be651808", "comment": "Malware payload (Mirai)", "value": "c576c35444f0cde9989c80329fb4768d6b65add2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122135, "uuid": "50feecbe-8b21-4796-a4aa-a7952d594056", "comment": "Malware payload (Mirai)", "value": "1259a74d685f0e5eddae656d3da1260545caf3a47e9d46c8b2fe6fb54b771dd2a36b850524821749e75e860be7f62bf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122135, "uuid": "22bcdac7-3ccc-4bde-9a87-1d81ad2c98e1", "value": "T192E20297D372A452DE383BF1F9AD85CA6BBD4B6CC17B3063190456182E8A0435F3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122135, "uuid": "5b04ece4-745d-444f-b295-8b6083f81130", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XCG9q3UEL5I2:korm1vpALgUJCrLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122135, "uuid": "0ee30460-5fa0-4067-bc7b-840600f0ab51", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122135, "uuid": "f27c52cc-4708-46dd-8ac7-0222e8dc1d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122135, "uuid": "8837bec6-e1a9-4479-9a2c-0e6b9960a9b3", "value": "4c0711f5e5b2b815441babcb8b446e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02acbef-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127859, "uuid": "46b6a60d-d598-4870-93c5-adea8008ecd1", "comment": "Malware payload", "value": "4b2493d809acdca8b79aa2e22c04144c", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127859, "uuid": "f230d8ea-f586-4313-8c13-5e2f91a3e665", "comment": "Malware payload", "value": "2e564cf199b68662850d7dc42b4f54d9ab34d7080ee2480f274e1ecf9952c1a0", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127859, "uuid": "095c7c8f-af75-4c1a-8526-eaa883690f68", "comment": "Malware payload", "value": "10de100f5e8b9cb025c9b24a53847ad7db78ceb0", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127859, "uuid": "24d57b4e-6c17-4995-9382-74bcaae1d88f", "comment": "Malware payload", "value": "e2a7f7b9134b56ebe8409e04b9b0b9fce6907be0d4478dbdeef95f3b27013cf35b5f36e51143196bb300a31b8a84a579", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127859, "uuid": "34b0c1e9-8b45-4404-8b5d-5c4e6c735a8c", "value": "T13355A8342A79BC2847D7EE6335F04A950DE445AFE430393B1A8EE5768A762C111B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127859, "uuid": "27564c09-6233-4a72-8f70-f2399cc37766", "value": "3072:VVZJ4KT2D0mj+FhaD6sc2b532na+2WAUV3ie7jg9c390RhmCfCkRsVak:VVb4KU0mjWa/s2WbVSSjCc3eCmUak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127859, "uuid": "7180b4aa-94ec-428e-a679-6a4082ee1521", "value": 1369863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127859, "uuid": "a7248803-4f11-413b-a528-0bac3be9a704", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127859, "uuid": "60c8583c-56b9-45d7-be35-1247851a24bf", "value": "HDDREQ.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6ad1ab-4d1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694048775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048775, "uuid": "99f9b28a-58f2-4ef2-b721-c5ed6016743d", "comment": "Malware payload (RedLineStealer)", "value": "24c47219d98b04c49e3a89aa2105065f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048775, "uuid": "6d248977-ba55-4e2f-ab03-b0fd60afa63b", "comment": "Malware payload (RedLineStealer)", "value": "2f27f32ea2ee1aa1b5085855ff553dec50e29cb5bec11d950766605f8d2150d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048775, "uuid": "20b0b596-7d6a-49e3-ab80-33b552c8433b", "comment": "Malware payload (RedLineStealer)", "value": "a7c596e9d27268b020d44e3dd7b39ae116a2de18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048775, "uuid": "3666c39c-383b-43f7-b5a2-62fe4e404158", "comment": "Malware payload (RedLineStealer)", "value": "62574108b33aedcfa59ac3fae519b5b03a70a121c7f69bf9c0cdae800f00e20f8ff74a20d0a1a640daa476241249a589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048775, "uuid": "99ead869-f40c-45f5-b858-ad0b0ef6156e", "value": "T143052252B6E86033CCFA773099FA23A70639BDA69A35532E3249154E1C733D1A47532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048775, "uuid": "cadf4fbd-e874-443c-b35b-fe6f476b35dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048775, "uuid": "cfa32ecd-c1c5-4937-ad4c-52359903d959", "value": "12288:jMrYy903OaxTDS/jxxSA6vWboI1DZdj/fl81tLFj0xx4cCF3recAH:/ygOKSLxFbRZZBlQtL+BCFycAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694048775, "uuid": "ff07a90c-b38a-43b8-8c99-1126684cf81e", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694048775, "uuid": "3cab2fa4-6753-4896-8aee-dd7a8d39bb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048775, "uuid": "56329abf-bd10-49a9-8593-93907b473191", "value": "24c47219d98b04c49e3a89aa2105065f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f3fc21-4d35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694060188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060188, "uuid": "e22e3322-ee22-4094-b707-7fe5686f484a", "comment": "Malware payload (Amadey)", "value": "aa12e559d8e01fb76e32d08e1faa87c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060188, "uuid": "1574ad71-367a-4c91-876e-0797c20529a3", "comment": "Malware payload (Amadey)", "value": "2fedf5a4dbea6191c084aa31b1cad76f68de5589da81a9774df870bdab3684da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060188, "uuid": "901bb200-acc6-4faf-98db-b8c945f3fd34", "comment": "Malware payload (Amadey)", "value": "6dca4ebdec3804db012431435f15d979d25e6bd1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060188, "uuid": "d0f2bca4-8abb-4e1f-a923-db9662c7114e", "comment": "Malware payload (Amadey)", "value": "ba8b0537f1013a160fee14afc11d39aba1d0860c77ebc3f83560b19ec01c81239b33c6aee3a0cce523aed7d7d339ea74", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060188, "uuid": "9282272e-9035-4642-8b3e-9170b848c33b", "value": "T15124F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060188, "uuid": "2f546964-c746-4a66-bce9-83bce6dc84ff", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060188, "uuid": "e92dd45f-4cd0-47d4-ae9b-6174461925ea", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694060188, "uuid": "43e37d11-6438-4f60-b3b4-fd48910090eb", "value": 225758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694060188, "uuid": "f90023cf-8393-4570-8ea0-38f5f885b977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060188, "uuid": "659d52f8-6e5d-4f68-905f-01bf3793a609", "value": "aa12e559d8e01fb76e32d08e1faa87c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cd36a6-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119309, "uuid": "0b59bd20-0c70-4570-9688-dbac20787d00", "comment": "Malware payload (Mirai)", "value": "aa49218b172f188942fe7b01ce8fb01a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119309, "uuid": "9e887050-402e-4798-868d-555118458978", "comment": "Malware payload (Mirai)", "value": "30e55f97cb744c7f54707f058bf13168f808e4c9701f916d5a9c8f10858843b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119309, "uuid": "fd04c178-4256-48fd-a4d5-9ae088361dd9", "comment": "Malware payload (Mirai)", "value": "b5485d4236d861e1ae19f4bb8ee1717f65a5bfe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119309, "uuid": "168d1b38-b211-4bee-a19b-c758f75e8ec9", "comment": "Malware payload (Mirai)", "value": "d4a3c4d2bd3953dc89df540d2d5bfcafdebec8b9dcd113e6d1d3b717dbb46a7aadfb96b8b042d92a411579b33af6e34c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119309, "uuid": "d0c50a95-da55-4cdf-a56a-f4e9f828e42c", "value": "T1E082CF3061AB75E4DBE14430FAAECEC6972A0BF8D1FC369316586B78C94150260FD3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119309, "uuid": "78304e15-3096-462d-bbff-5c5a016bc41e", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaHhymdGUop5h5lY:6/V0P6+kom0tVAoNvm+to1Hs3UoznlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119309, "uuid": "f1b66b44-9e17-4c6d-b4da-35b6f652fc1e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119309, "uuid": "e64e4024-3e63-4b64-a956-7c040edb8e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119309, "uuid": "6b64e55e-b16e-405f-9c76-88afdc9af961", "value": "aa49218b172f188942fe7b01ce8fb01a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6260b373-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102737, "uuid": "ed2d078f-f53f-4b12-888d-9a499b5f09de", "comment": "Malware payload (Mirai)", "value": "ede2096193c0f8b7f55eded426114708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102737, "uuid": "e38ef986-dc97-4482-813f-1fb5f046476b", "comment": "Malware payload (Mirai)", "value": "310df609e2bd4d56f69a8528300166376bf2c78987da612f5e7f0fd44e3b23d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102737, "uuid": "04c49f13-291e-4f99-a0a3-a3f131482cda", "comment": "Malware payload (Mirai)", "value": "1515e770d8f2a491d7ebef8efc8176b2509fa7db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102737, "uuid": "eb22decb-fbb2-403a-bf90-8fc57278bd60", "comment": "Malware payload (Mirai)", "value": "bd1a4997fd24488cb8694920aa31c60b75f454cba9c0a5aafbb8775b71e4230ede5b2d35f1d4b2b84c458febc7b1e600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102737, "uuid": "040bd58b-0fd8-4634-befa-bc37c10a32ea", "value": "T166D2D06EE5B442C5FD8D5C7E808C3BA10E19E581231BDB9667128C8E5B32C17F26E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102737, "uuid": "dfdff6ce-3445-45a3-abf4-b52d353a007e", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjGizbRWGVCz0Nvn:8MYHb62x4ahQ3CfdwLjXAWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102737, "uuid": "17310825-3695-467d-8dba-154d0597105e", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102737, "uuid": "131b6186-132e-4a2c-a868-3901139c1004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102737, "uuid": "bc62fe16-f82b-4eea-8d97-64161246389f", "value": "ede2096193c0f8b7f55eded426114708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1768ccf-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096025, "uuid": "3dfb6ed5-fd80-40bd-b11f-bd29639c2086", "comment": "Malware payload", "value": "7f3441e4875f5c868cfa32c6a7dcad50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096025, "uuid": "6913fd10-b6fc-4431-ac97-3351468d302f", "comment": "Malware payload", "value": "322ae4155bb2e086572d1dd88011d7df98ee56edcdcf15557b4b5580b9535666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096025, "uuid": "97fe2b22-e331-441e-bcb3-afa656cee8f8", "comment": "Malware payload", "value": "22d326d1cd2dc0fd509e69f367c7bd98218cf7ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096025, "uuid": "3112b31d-d63d-4869-ab84-077d068b58aa", "comment": "Malware payload", "value": "5ca4250f540924254968c4a2abdd50fbf890df803fa8e35e232e1305d2368f90b55f28c11431018182a95382ff994cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096025, "uuid": "fcded104-07d0-485e-b185-c9246994b830", "value": "T195235D4037D8C13AF2BC47B4ADF2A2058679D6576903CA996CC824EA1F13FC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096025, "uuid": "a0524c59-aef9-438b-809c-48a87510162c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096025, "uuid": "7b847f4a-63db-4a6b-988c-552baf13d1eb", "value": "768:p9umxLiIL1CaS+DiB0Ni5t8Ybfge+0fX5btosTy58vEgK/JnZVc6KN:p9uAPWBBzboqXFtbTyunkJnZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096025, "uuid": "5516b677-8284-4a3c-a86d-498a7cf026c4", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096025, "uuid": "b2dae51c-2eaf-4abe-b7f8-bd0b7e49458b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096025, "uuid": "3b68d6fa-9f5d-47d7-b730-47f217af8bd5", "value": "decode_5494d5ee33e4a4b4a26e09b28d9774c5ad82df88d4ac276466e830ff131a5f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afa285b-4d9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694105409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105409, "uuid": "cc9ff10f-42e6-4e51-a8a5-ae6dbe6e71c0", "comment": "Malware payload (Mirai)", "value": "a3dbec3eb14765e2186c2c3f25bb6b6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105409, "uuid": "32a8638c-211e-420c-896a-1fa8f678d72b", "comment": "Malware payload (Mirai)", "value": "3234316bf46acb737b5263bf9cc710ce886fee27e43cb28e07e162dd0de3ea8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105409, "uuid": "c3277360-d1f8-4224-b539-a09418d765c9", "comment": "Malware payload (Mirai)", "value": "f51a6cc21826afefef614d02c294218c1f338a57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105409, "uuid": "9c24f106-0826-40cf-b4b3-2a7d31d7b7b2", "comment": "Malware payload (Mirai)", "value": "b6b4130356c08fcb14d5fc04cd37a94e71319cf9333d3389bb10cae87c12cc6956d61dc30f60032475ad442a9988848b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105409, "uuid": "276e0fd1-8587-4e68-ae14-f9ea22b92230", "value": "T1A1632992BC819A02CAD412B6FE5F519E371613D9D2EA3207AD15AF2037CBD1F0EB7251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105409, "uuid": "0c46528e-2855-4d98-8847-ed27ae14da24", "value": "1536:8SRc2NNnKCTn+dokC2gFTzs5Zj8U7RWQIpb7G8Ilx1RVvx:8SpXnKinSTE3qlATpfGZ3dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694105409, "uuid": "240503b7-a6a6-4438-89a1-89f69d83dc17", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694105409, "uuid": "42fdf4f2-402b-4697-8a5b-a652e6418ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105409, "uuid": "b5fdbe25-34a7-401d-a8ba-b7ef494cb51d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacf77af-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075800, "uuid": "62783a22-2fe2-4ea1-b173-1b1853fc1eb8", "comment": "Malware payload (ConnectWise)", "value": "fc1ab75e96bd18f3f6aabb1789d3ece1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075800, "uuid": "5b056440-df19-4009-8a2c-5ea0170ba1c9", "comment": "Malware payload (ConnectWise)", "value": "3246fac883f8036b4bee06248b73bf9a2261820d4d16d041c3f541cf74ff616f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075800, "uuid": "76d5c7bc-f980-4e78-ade8-58e7ff76c985", "comment": "Malware payload (ConnectWise)", "value": "f51ee6ecfa98f5cd288c908fec8c53d22e75cd48", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075800, "uuid": "874b70d2-d09b-4a6f-a867-e88a9c950d65", "comment": "Malware payload (ConnectWise)", "value": "1e1f627e2d171a6060c59126f141a69e05b4e5b7d3d75a465e966578425e0adb646502d5aafc2452837dda7b38cd1c17", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075800, "uuid": "3caf5e75-6df4-490d-80db-696c40d6a644", "value": "T10A836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075800, "uuid": "7e264f5f-b02f-4b96-8036-22cf3e295c15", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075800, "uuid": "43b93b01-c704-4987-8765-a7179bf41266", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Pk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075800, "uuid": "318e667a-1c60-46e8-a1fc-64ce74e6076d", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075800, "uuid": "fd9f93ef-3b67-4792-ac60-19ce42f87bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075800, "uuid": "6303d038-ca06-46ae-b5bd-3eb236113a37", "value": "fc1ab75e96bd18f3f6aabb1789d3ece1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6bddaf-4d3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694064713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064713, "uuid": "e72dbfa4-0c5a-468e-99d7-3764e11671ea", "comment": "Malware payload (AgentTesla)", "value": "0c2b754fe87562426927ada25ed895c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064713, "uuid": "6a874056-9386-45a3-aaba-74ec815cc824", "comment": "Malware payload (AgentTesla)", "value": "327f487c6ed34bbfc7d0541d081129d7b4bc4a6e071ed7750e9817da24d5a523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064713, "uuid": "ae9e98db-4bd5-4cf4-81b3-0de5b5d73055", "comment": "Malware payload (AgentTesla)", "value": "3c19cd6752bc173b00e0bff999c7dbd9eb035f01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064713, "uuid": "467c65fd-bd2c-4cd1-bad3-6729b7fc1a2e", "comment": "Malware payload (AgentTesla)", "value": "9749a97e227fee6d7f0cc12c36a47751237324048cca2b3ebd4928067e186f920d3910e12a66b7ca16062a67f2aee67a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064713, "uuid": "41624a1b-d8b1-4f3c-bc33-c10a585a79e1", "value": "T1DBD4231025600F71D7BF13F7101218540B7FA60E2DABEE491EE9E2D98772B1967E3A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064713, "uuid": "a74ebbf8-5ba4-4322-b6ff-8d859e1ad398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064713, "uuid": "20504d19-a3ae-43c2-8d52-aa3b85464ee5", "value": "12288:S4ZWR5Ksp80x7dmxuQareVxlg9IYZ9a7Fdt0aIXbb5fVsbRJ:S4k6addQmeXlg9IC9a7Fdt0RXbbtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694064713, "uuid": "b5711a82-a150-4064-acb8-ac5ee5486046", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694064713, "uuid": "861e3df0-c84a-4c2a-8ba5-76c733f9b045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064713, "uuid": "df4eedca-4404-418d-9a1a-2be48c57656b", "value": "SecuriteInfo.com.Win32.PWSX-gen.6245.5931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0457106a-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694069079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069079, "uuid": "46056e3a-7296-4f3c-997c-c513b5a59403", "comment": "Malware payload (RemcosRAT)", "value": "497d12ebcb77c419646b476cf3362cc9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069079, "uuid": "6f9776e2-ebe5-4b22-9ff5-8d4da0b5175b", "comment": "Malware payload (RemcosRAT)", "value": "329cabdb978ab3b7e71c9746d34b20a67b85fe8aebdc9c5114448f7ca232690f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069079, "uuid": "91815b80-61a8-4a20-9a8b-53cbb502ae62", "comment": "Malware payload (RemcosRAT)", "value": "0a1cc964cede39d581d3e1c0c0b4f8b4e5ed4138", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069079, "uuid": "c6be6925-508b-480b-a96f-5d3197b1d8f3", "comment": "Malware payload (RemcosRAT)", "value": "ee65e636df9a8fa124a8e8860d02b54a42644a1a4a3df34ab0eff668407225621a1d2469b9d17a52b0c21866a2e891c5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069079, "uuid": "140c82e6-f659-4757-8c18-b3ee69e1ba45", "value": "T136A42334BE70D92AD0528EB413BB6F2B4BB7CF5552505A471325BA993AF23C3DE48630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069079, "uuid": "718d59f7-3032-4728-8211-db2fd25de190", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069079, "uuid": "7408f9c7-8408-4705-b86e-c8b74adb48ea", "value": "12288:W5kaKsCgI1BadYDtb0lMkQj/SGFZ5w66gBEkMc1rC8C6f/:Pa5CH0n+Vimnf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069079, "uuid": "182d6f8b-274c-4a10-86d4-5b3df309d7b6", "value": 475408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069079, "uuid": "0aaa4692-d2b8-4cf2-b83a-7ab0abfee0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069079, "uuid": "7ecfea70-db4d-42bb-9b77-cf5ee71ca0a9", "value": "DHL PRENDAS Pre-Embarque 32PM4433.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf9e6cf-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119316, "uuid": "643df312-987d-4336-871c-a6842a34a0b6", "comment": "Malware payload (Mirai)", "value": "ec5a20023b2651bc6c44162b951a7820", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119316, "uuid": "00013058-5151-4e64-9a42-06d94531d3c8", "comment": "Malware payload (Mirai)", "value": "32d1a16a0d07190769de94fe6e8c899ed30250b7a4236e8bb3136556c333323d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119316, "uuid": "b2798c55-a8b6-4253-93f1-c8394ef26d73", "comment": "Malware payload (Mirai)", "value": "bcccea81a773d066fdaa5fa75da6ba8f9e557133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119316, "uuid": "6ab7762d-240a-4492-b451-ac16b2ad169b", "comment": "Malware payload (Mirai)", "value": "34637a4eb095a426913456905b7d6456534e2e7dc3740bb7b6f504f61d1b1c9a21c3d13b303eb5f87287e000372ca331", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119316, "uuid": "3d769ee4-b5d9-4515-904a-340073a4f547", "value": "T1DBA2D01572A32DA6F3AD1C3DC96A835BF9670BFC90F5327579415620C90D24A2E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119316, "uuid": "be9b701a-5c79-4de7-a555-1b40208df87a", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjDThymdGUop5ht:vvQn4j+ZO5fKAlx3Ts3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119316, "uuid": "1cef36ea-c1a8-44e3-9eb3-e81eca4270e7", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119316, "uuid": "76f76e96-6c9f-4e06-9ddf-80663eb09704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119316, "uuid": "e7cdae99-2acd-41ae-ac57-8c107ecf5d79", "value": "ec5a20023b2651bc6c44162b951a7820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d42299-4d73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694086905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086905, "uuid": "148d83d9-ad30-4b57-8513-c968805fa309", "comment": "Malware payload (Cosmu)", "value": "0787bcb9da6117445ca7fb7d67c2b0e5", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086905, "uuid": "2877e7cf-3226-40d3-a038-9db367321543", "comment": "Malware payload (Cosmu)", "value": "33187824fd6fe3db23edbee8bfa6946478d298140554045c326b7ba9c3c66833", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086905, "uuid": "27d8ae42-5465-4d5e-8502-76aecc7bc7e8", "comment": "Malware payload (Cosmu)", "value": "9c3fc49ebb7a51c02fb26a284d0ee15238339074", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086905, "uuid": "5fab652e-d6d9-444e-9b30-170c31c646a1", "comment": "Malware payload (Cosmu)", "value": "6b188fc60f7ba041f651b0559dbd8fa1ffc301e77c7337a1d5ef82f1e658f9b7083e001614386cf996eace5db770689d", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086905, "uuid": "d98951ae-fbb2-4c91-aaae-dc812b4d9d88", "value": "T1D394F1417AB1D8B3C48645368CA7CFE55737FD128A20C1C3FBA9AF4F2D712A19A32245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086905, "uuid": "50a07aa8-5011-46e6-8e73-4f4e9b608bd2", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086905, "uuid": "42665d7e-1c97-4a9f-8d00-421f6db9535f", "value": "6144:bamlKgzelZNQSBQGH/CSpWqTCNs6+X7jINs6+X7j1mQ:byfBQGH6Sf76+X/l6+X/oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086905, "uuid": "fc54db65-5bb4-444a-948e-85466557a0f6", "value": 413638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086905, "uuid": "5454d0a2-447e-4333-8da0-0d437afe4ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086905, "uuid": "6f17987c-595f-48ff-9fec-ea9674ca2f43", "value": "Virus.Sysbot.ATA_virussign.com_0787bcb9da6117445ca7fb7d67c2b0e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1dd72b-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694090410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090410, "uuid": "d9e5a3b8-d657-479e-9a17-14d136a8d10f", "comment": "Malware payload (AsyncRAT)", "value": "54739cbd63033b96aa9ca700dee47d03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090410, "uuid": "383ab8dc-432f-458f-a7ec-91390249faa8", "comment": "Malware payload (AsyncRAT)", "value": "3350bd029ed438e1b2bcd7548964ddff63307040bb9e230deda1b39f760c13dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090410, "uuid": "eba8c9d5-2bee-4b3c-aba5-1f851eeb99c7", "comment": "Malware payload (AsyncRAT)", "value": "f852ddc25fb84b0f1064f23fddff3548de30d10a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090410, "uuid": "ad14eac7-b0ea-4d13-b41d-df506eec536a", "comment": "Malware payload (AsyncRAT)", "value": "3cd1bf13d64cb300459c086b1aed6fda3a086c0b265899c444037e3ddedb31f4cb4c5de0855f810ca91f4371dd4c0463", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090410, "uuid": "c837b7fa-b85a-416f-9c0e-19d453e3eeb1", "value": "T153242B72F3889B4ACD51F4BD91B320A920EE1947DCA69947E6EE293704F05342B274FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090410, "uuid": "f5b2f287-baab-4e75-9cc2-ebbcda407b8e", "value": "3072:dbC+VQs8luIlKUv0re0re0rd0rE8ti8wrgIteEWEjwczIJs1puhS1ePih8mjqUfN:dbC+VY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090410, "uuid": "a3a49926-fa26-4cc6-b7ac-148b2b824099", "value": 218304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090410, "uuid": "6c030096-4f0c-45a3-b2e2-a3f24dbdd907", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090410, "uuid": "c14dd7d7-cc42-467f-81cf-ba3a0790c760", "value": "5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82855dcb-4d4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694070149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070149, "uuid": "11e2933b-48ff-46ae-bd86-35a1ae0e9ef5", "comment": "Malware payload (DCRat)", "value": "b08bc7c641a6ee11ad6c6544a763954b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070149, "uuid": "0fe85fd3-a4f6-4662-86e6-76f65c4b1454", "comment": "Malware payload (DCRat)", "value": "33c74d575c87fa2a7a63e9352477b2ddd28b925af1d590065de73f8cfe7ff0e9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070149, "uuid": "14b9b55c-b8b5-4bb2-972c-58c57e54cb12", "comment": "Malware payload (DCRat)", "value": "26914197401ee73c4a1792cdbde4ab93b53da58e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070149, "uuid": "87a77d89-beb0-4c3d-bc9d-e45c9a6bb065", "comment": "Malware payload (DCRat)", "value": "51b01a56b983d8b12a40b57ee82123e42c2c65b6b0b3540349e7d3a782f28edce7c9619d41f6ab0c5e42d5c3690760e0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070149, "uuid": "0a48f129-9cc2-41cb-8337-03b27db40a53", "value": "T11F556B167E94CE11F00812B3C2EF494847B0AD516AA6E71BBDBA377E15123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070149, "uuid": "485fc9b5-f424-4bca-b0d3-d231fd86b4fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070149, "uuid": "86875c37-558b-4334-9350-32428bd5cc2f", "value": "24576:xHdBBv1Xr4mg/TtfEsCFGls/PRQEIYP63f54awI+acqmCy/:xHP1174mg7t6TPRQVn3fr+acqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694070149, "uuid": "3c648296-7bca-4926-a755-385ad8d6a0d6", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694070149, "uuid": "ac576040-dae9-4660-9445-46e26a49ed32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070149, "uuid": "a31a570e-0981-4953-a1ec-f4d73ff94179", "value": "b08bc7c641a6ee11ad6c6544a763954b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96086902-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075765, "uuid": "f2eaa4a4-e59d-4672-95c2-bf27eae361cf", "comment": "Malware payload (ConnectWise)", "value": "e7b85f65e435d30f547c091a0c5fb1d5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075765, "uuid": "3c6ed028-389f-4c3e-83d7-0e91fa124f07", "comment": "Malware payload (ConnectWise)", "value": "342cb63d1cc38c690dd9246ba334b9d7660e575062457f995ef9c54fe52ea81b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075765, "uuid": "ece484b1-602e-447a-95db-9e5e03955447", "comment": "Malware payload (ConnectWise)", "value": "0114e1036f7ab6992220ab4b8dde9c18009d7271", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075765, "uuid": "41ab9532-a966-4938-963c-113ac5774036", "comment": "Malware payload (ConnectWise)", "value": "ccd8622307b44a31354c71077415a5ac541f3f694c22f56d53645f723e322cf730d5df0f17df2a09ed316121b75d3d6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075765, "uuid": "1356b839-a04e-4924-89f4-c6644de5e1d8", "value": "T1CA835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075765, "uuid": "46455c43-3f89-4c98-a3d7-f4e7cd44d53e", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075765, "uuid": "ea9b01cd-6e46-4197-9e74-7743b3dd444d", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3ck:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075765, "uuid": "ae985cfb-1214-42fe-bc29-3883736d565f", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075765, "uuid": "3acecc36-21c2-4c26-b518-91c0a6fa264c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075765, "uuid": "c27de8f8-2945-4c3e-aa9c-4db170142f6f", "value": "e7b85f65e435d30f547c091a0c5fb1d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974cc0ce-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694103685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103685, "uuid": "17c0ef89-00fa-4f38-b11c-d8362f303828", "comment": "Malware payload (RedLineStealer)", "value": "d20a7d4729946f23a0f47ee20b3c6863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103685, "uuid": "82dd664e-d4ea-4d7f-954d-877fbb42e2c5", "comment": "Malware payload (RedLineStealer)", "value": "344e886fb7e22bc78b9acadd8a6b62a04df0980e81a9d28421e2cff2478829a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103685, "uuid": "0ffea65d-5346-42fe-b0b7-4d277b2d62ea", "comment": "Malware payload (RedLineStealer)", "value": "ee3555cd7f472981011521088f6fd0862ecae927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103685, "uuid": "debad3be-8f61-458e-b08a-ff7460374797", "comment": "Malware payload (RedLineStealer)", "value": "62fe3d89edb17d85aec7442a2f5677b7bff984e5977253993061fd45cc5fd67ec16fba5e17602943457259036321d866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103685, "uuid": "13e94f26-9548-443f-a50c-62aebc271710", "value": "T1D084F157A7E94472DCB6277068FB42831A36BCB19D74832F37949C5E4C72AD0A87132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103685, "uuid": "d23d3c74-f60b-43bc-b46b-50b4c47edbd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103685, "uuid": "fdaa346c-080f-445d-8d89-c4a9d3e28024", "value": "6144:KRy+bnr+np0yN90QEkwHZ4W7F3bv71u5Y5P4CKr5iQBvd1C3bgBd5LF4e:PMrLy90bFrv7MeUXybgj5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103685, "uuid": "fe986405-9f34-4181-95cf-b6c83249ab4b", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103685, "uuid": "709afb94-bb82-436d-8158-f1498765b93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103685, "uuid": "9a8504d3-3ad9-4475-81c0-e1fd5e95577f", "value": "d20a7d4729946f23a0f47ee20b3c6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b2e081-4d63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694079825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079825, "uuid": "2be67e44-34cc-45ce-98a9-32313e654500", "comment": "Malware payload (SnakeKeylogger)", "value": "a9529f4cce7ec84caa62bdf8de300649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079825, "uuid": "13bc561a-31d7-4409-81af-28d47d83067c", "comment": "Malware payload (SnakeKeylogger)", "value": "347a49b7e5d032c2585811ec299182ec24139fd12d967aea4749e44cf0c6dc9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079825, "uuid": "371f7942-7860-4ce4-982e-5c5ce9702207", "comment": "Malware payload (SnakeKeylogger)", "value": "a859a9f2456cb2e562d16ee7bd2aa48cf67b50b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079825, "uuid": "6220bbb0-88ee-49ff-9f60-1c1714b0ffc4", "comment": "Malware payload (SnakeKeylogger)", "value": "009078417f2e6a793be8a225d5131e44c16027d64d159326ce29fa2216b7ed576066aef259b84f35e19e37ddfaabecbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079825, "uuid": "407ad79d-fbee-4f90-b892-e90bd81f8b60", "value": "T143C4DFF8246AC3E2E7B4A7FF54A790758963BC10A07182DC377D3A444DE5AD31A22D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079825, "uuid": "a9543b59-c55e-402c-90af-4e28d8d66cf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079825, "uuid": "2bd2986e-75ff-4295-8ee9-7cc23d1c4ded", "value": "12288:g5fVsbR24w+46v5VlRHG0ZR/HRETr7u8QvAROfAR6ER9yj:gtO24U6K8HRorSvVfu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079825, "uuid": "b39bd0c6-4f6d-4530-a361-f3d8f2c41383", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079825, "uuid": "8b187dc7-9121-49d9-9f55-beb7468b50d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079825, "uuid": "c89c3c83-4c4b-4e93-852b-57745b12a96a", "value": "033MSOG232441305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f15ec2c-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122166, "uuid": "d757bc47-473b-4215-a0d9-167ef397a14c", "comment": "Malware payload (Mirai)", "value": "bd4d15c05722273a1270847f3e01713e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122166, "uuid": "4c304d11-5fe2-437f-b68e-ba2df8bd63b3", "comment": "Malware payload (Mirai)", "value": "3489f573476460e20a88252eef7452936cfe532e26a425ba82bdc7a4b09cc485", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122166, "uuid": "6a7982d8-034c-4d1a-836a-376d6b00875a", "comment": "Malware payload (Mirai)", "value": "6a4296b17af86b49ed966adf789dc6b009207be9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122166, "uuid": "4c3c6c91-58d2-48ff-bebf-c3b4e7ceb9e3", "comment": "Malware payload (Mirai)", "value": "8510918a747228de2997e5fb17e3f8f09081d8ca9590f69f69e76fabcb293a65cac0eed08efe921bee749b923b9735b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122166, "uuid": "5c1c2a53-b5c9-4e9c-8be7-9c9eff4f09d5", "value": "T12E33F2A22B6E1AE1A1B05777BC33BC1A62DC17F99D6730E62CF0561577C58024FF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122166, "uuid": "99004141-f22e-4da7-9362-2856d4a454d7", "value": "1536:d9O/ZMAXIxNUk0OHLcPqF1aBexo4opKZbs:d9O/ZNKyQLGqFUFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122166, "uuid": "da10d2ad-bd68-41d8-bbb5-810084a1c78f", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122166, "uuid": "044ade20-5e39-470f-ad1b-f5672c00d11d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122166, "uuid": "6b1c24e0-a8a8-4feb-990d-5c69b6ac976a", "value": "bd4d15c05722273a1270847f3e01713e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a7be89-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694069405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069405, "uuid": "8201a48b-34f0-4c2f-9d7f-3520ff5f8a0f", "comment": "Malware payload (Mirai)", "value": "3b3655e09209bc7819843cb18267fdff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069405, "uuid": "c4bfbfec-3c1d-46ed-8b4d-aba8e48bc9a5", "comment": "Malware payload (Mirai)", "value": "34b5e36f680ff915361ccd3a6ad8c7a8d4f9abe79be4550bbb1d2ed3fd6e1377", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069405, "uuid": "e068798b-6fc9-4ad4-a687-274bf7c900d2", "comment": "Malware payload (Mirai)", "value": "fe52f3bae0d9fc17773064efa06dbf050b0fe412", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069405, "uuid": "070dc687-f3de-44f4-a767-13b2edfb5af9", "comment": "Malware payload (Mirai)", "value": "bef80832fb2ff593391cbde8591f1f59878a1f0f5a9e40a1ec18aa98a903388aba055cc01c305671b7bb62fa39a43375", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069405, "uuid": "4167363d-6cf2-4b33-a26b-3cd5d5353914", "value": "T1EEC2E0BC7EBB6F43CA2700352598FE3742B0A5A5D36BB6D7B24485016C130E5AA63CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069405, "uuid": "87010995-addd-4ee9-8e50-c7742e8d5fcd", "value": "384:Mg1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjWueR:RMw4DZdFbBy6x3K/KdWnH57ue2en0NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069405, "uuid": "f9d8e0b3-0ad4-46a7-b55b-9e4ef174583f", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069405, "uuid": "0e4d2509-ae74-4d07-9d00-16f492c39c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069405, "uuid": "45b2cb4f-19e5-4c37-9ff5-dc785862f84c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fced04c4-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081522, "uuid": "11b63e91-aabf-4fdb-a129-b08e8cd427ab", "comment": "Malware payload", "value": "837c03efe67cb0f2bcb6e579b95d9927", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081522, "uuid": "3502799d-51db-4a69-8261-a55cebfeb76c", "comment": "Malware payload", "value": "3513fe9c2c3f970891dfb8d552cee49e1a7408f180bc19153355112eab17ed50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081522, "uuid": "485fa758-0a32-4946-9eb0-88a5aa8f44b0", "comment": "Malware payload", "value": "b881607fa65afcd83b16bdf77d122b3d9c1d25f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081522, "uuid": "7b56f448-3a1d-4939-9123-dd022779bc2b", "comment": "Malware payload", "value": "03b2e3678a4e9f553b630d9d61126ca64e362c024e849856de8a3d440301dfa9e187c2ced810adfe8330ab0bca31a67d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081522, "uuid": "c4b1b78e-eb61-4b2e-8f0c-cc49b5903455", "value": "T1B2B32743BE80A8B5E86E0D79852897744B2EA920DFF27DE7330419A94E746C3DD34F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081522, "uuid": "b169f139-74c1-4650-9b9c-f24a56d4abd2", "value": "a7a4677b6ab2ab72cfafd708ff80ae20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081522, "uuid": "485af85a-fd5f-490f-bf70-3424723d36bc", "value": "1536:y4wDyN9JVxcsS/xu2hLmf4jggSbclCZGzswZ2ZZCrBsW1cdbyVFavAbUk:y4OaDxsxpLmfyAbclCZgEUkbyVFWAbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081522, "uuid": "9bd849be-751a-4b02-ad28-f4c7dc8849e5", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081522, "uuid": "74c8849a-7f84-488e-9dd0-55575922fbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081522, "uuid": "cf683ef6-f069-4d08-aa2e-b973a8539c2f", "value": "DLL101.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b051c6d3-4d54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phobos)", "timestamp": 1694073662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073662, "uuid": "d7f56ca0-1c8f-4d74-b7dd-5402011bc879", "comment": "Malware payload (Phobos)", "value": "e244628c750d40509ef2e3e72e4c2049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073662, "uuid": "9ee08ee5-deff-4b31-8d79-f10416a672e1", "comment": "Malware payload (Phobos)", "value": "356799503f195db260e08a81d42a431b4ebd47cef94eddc96f24a0fd3e49d716", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073662, "uuid": "2043c4dd-0291-41e9-a3cd-f18d95e07148", "comment": "Malware payload (Phobos)", "value": "f823f35c00580524fef34d9084721a4cea703016", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073662, "uuid": "7e1a599c-3544-432a-8183-5c562372bb9a", "comment": "Malware payload (Phobos)", "value": "7fbbb13aa4cbcd9ec58ba0d67ac3d9935b9b13cdf48c342b6fa140b99eb9caf3e04279cb21b62d542d67a7cd5f5c1463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073662, "uuid": "559ed92e-6220-4172-a90c-a704fc075096", "value": "T1A8D43907BA4EC9E2E2891736C69F450403B6D5C2639BEB0A798F23B5D8C37A7DD42507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073662, "uuid": "93b224c8-4a52-4762-9ebd-323d5291579d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073662, "uuid": "d6d4ea01-25d4-41b5-b245-7793df419e02", "value": "12288:Etj+xbGF2Wi8qpq3ll2iEpiXH7Nu6GKy:aj0E2WNq03l0rpiXHhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694073662, "uuid": "00bd3fd6-015a-4588-a78a-94f278551986", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694073662, "uuid": "e4ddc23e-3ff4-4b03-85e2-dba86b35b86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073662, "uuid": "070d922d-d459-4421-b67c-20907b78859a", "value": "e244628c750d40509ef2e3e72e4c2049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752162e1-4d1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694049081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049081, "uuid": "094a5412-8a10-4807-899e-1d02134b3734", "comment": "Malware payload (RedLineStealer)", "value": "07536ff6f012ef6917af2bf087807bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049081, "uuid": "51aa0e72-ffd8-4060-8a8a-e2e8a7d4ac0e", "comment": "Malware payload (RedLineStealer)", "value": "3733691c9c5951d207f9ee6d44ce59582705e5677111c2ff56105a1a8ee623af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049081, "uuid": "758d43f5-3bac-4916-9997-f752f23119fd", "comment": "Malware payload (RedLineStealer)", "value": "42811b56aeb6abca7a2c00a8046e23a10dde9123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049081, "uuid": "48300b8d-abfb-40e8-81f2-4eeac43a35e2", "comment": "Malware payload (RedLineStealer)", "value": "5923c29d5ce1b554b1637493ce57fb1261103e95879d447df5545d73bc6cf79906c2b8f139c7dd4bf58bb79471134e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049081, "uuid": "5804d5d5-69ae-4939-936e-dedf3329f6e2", "value": "T1D1052301ABECC063D9F0177059FB07D71A35B8138874876F1B89A95A1CB1A98B67237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049081, "uuid": "acd86b96-e4d8-424d-a6c3-e7e3a73658ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049081, "uuid": "b352ddf0-e41a-43b1-8595-a49b1de65fc6", "value": "12288:WMrey90yhbO4mHyh+AKnoibyqogi13af0PxwuyKRyOZFJ/cnAis:0yJhb+/mq9i1K62uyKRTFJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694049081, "uuid": "ea4b0c95-23d9-4b9b-ba8c-b9d8b95707ad", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694049081, "uuid": "f4b30c4a-126c-4451-bc6c-547a91342d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049081, "uuid": "9d5d2327-8401-4f49-96b4-9a3a67001ffd", "value": "07536ff6f012ef6917af2bf087807bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c62123b-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694075615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075615, "uuid": "46dd648f-bfa0-455b-8937-93a0cdf4e3cd", "comment": "Malware payload (CoinMiner)", "value": "4c328b215a84c1b2c982a3268b4a0cea", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075615, "uuid": "64d54213-e46c-482f-b850-f613bd43f158", "comment": "Malware payload (CoinMiner)", "value": "3761032e760a2bcc61854a0c7cf22e8e991af0ed60fac92b981853eadda00d1a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075615, "uuid": "157889b5-a31a-4330-a60d-5c9306756651", "comment": "Malware payload (CoinMiner)", "value": "addaaa78ce3f457d008a4958b2c1a404dcc62eaa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075615, "uuid": "a75bb76f-294f-4216-b374-b28cda9caba8", "comment": "Malware payload (CoinMiner)", "value": "ba82b742e9a6ff2483b7d5c32fa9d20aefafa2979d2ab8f17d0058fe076257147f49177accdc8b68c2ac3fec07cbc26d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075615, "uuid": "7605abb6-d20a-46b0-8893-d2f426c7d5e0", "value": "T177A6D129212BDFA9E391642B7F7AEFD2F44A39177A1B4FD14C44813EC21643B9997C20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075615, "uuid": "c0a99ce7-715f-4f75-8a11-16afb6f31d27", "value": "fc274ceb5aa20e8c9a5eb18d1be9c77c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075615, "uuid": "39127cb3-f44b-4ab7-b571-5534996ba4c9", "value": "196608:OB+EV10gI3ZrS8kJ9SW1Y9ILzsjTL0UkhtUuQ:OB+MOgIZSD1Y9ILzsb0U+tUuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075615, "uuid": "9722da84-c490-451f-a79f-571117995dbb", "value": 10416488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075615, "uuid": "34bc610e-e4e4-48aa-be9c-82803c8c130e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075615, "uuid": "92dd3453-106e-4d17-8f36-9900631828e7", "value": "SecuriteInfo.com.Win64.CrypterX-gen.16599.19591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101fc1bd-4d63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694079836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079836, "uuid": "00740657-872d-428b-b72f-f0c3ec4d7516", "comment": "Malware payload (AgentTesla)", "value": "7f0164a8c458478898f4da56ed444626", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079836, "uuid": "9eb2beb0-19f2-41ac-bb07-7e3a3bd26006", "comment": "Malware payload (AgentTesla)", "value": "3818e7bc26a06d573b80d3c4a4cf39fd928bd7321757f696eb0d6b67eee3634c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079836, "uuid": "75a78dcd-58ac-4917-95c0-9aebabff10f7", "comment": "Malware payload (AgentTesla)", "value": "cd5673fca2bae727d5f83b071320ca093cc41e90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079836, "uuid": "1166e6d5-81e7-41b2-b57a-bed8198e70f8", "comment": "Malware payload (AgentTesla)", "value": "aaa6848cc72a1014f6b5e2faa4ab3a036c092c37b7acce75327567cbbe96109b57cdabdf432a54f85ad0850a6d605f89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079836, "uuid": "50b58095-dd2c-490a-b9f9-1844cce087ff", "value": "T1AC435868C34F01A9CF56523BAA574A0942FDBB3EF24452B1306C437533EED2E95222BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079836, "uuid": "55118053-e00b-4230-aec7-8bebbd5a2904", "value": "768:zwAbZSibMX9gRWjguby37svGMe7r8YWSVvERdAAn:zwAlR9y67r8zSmTAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079836, "uuid": "0f9ae28a-d63e-4742-ba12-b165cbcbf0e7", "value": 59089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079836, "uuid": "ac3b75bb-82e1-4f1d-9d69-0faa7bd447c8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079836, "uuid": "36232470-818d-43a6-bcad-63501ee70eb9", "value": "OFFER ADLA ALUMINUM SA A2876AL301.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40941ede-4d17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694047275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047275, "uuid": "cd93743a-ba05-4ccd-a91f-6fddd0183254", "comment": "Malware payload (Amadey)", "value": "d43a14eafc0552fff5bcaa8ef46db8bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047275, "uuid": "0ae95226-0d26-45f8-a42a-265b4e137ac3", "comment": "Malware payload (Amadey)", "value": "39cbfaa8259e45e833ae22fe474ed6c467d41a521894060bdb63a3a650145553", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047275, "uuid": "7c71d484-0039-49ac-8750-51c16761ab5d", "comment": "Malware payload (Amadey)", "value": "4e31cbe371ed5c3365ef940cf08c2a7b4bb0bbf1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694047275, "uuid": "30bbb7e7-57e9-485e-9101-9d9b43955e12", "comment": "Malware payload (Amadey)", "value": "eccb8d2942a88d81e11e8feb60419b66c91fc5ddf7d6978709eb0baf92bbd3cdd9c7b1e90d811eadb488453c92a8fa63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047275, "uuid": "4df6a93c-0984-419d-a26d-1166b35d61dc", "value": "T19D051217B6E851B2D4F227B018F613D3173E7C9249B8479A7351AA5F1CB3A80A238777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047275, "uuid": "3b4ace81-f1f1-47dc-83df-126a70a89345", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047275, "uuid": "c8978858-3746-4873-a754-e53436ffaefc", "value": "12288:cMrqy90lVxViR9EsuzPiebetrRxEb5SX+MYIySuO5X6r1Q9uPHPVR4cRsDCk7:eyoivEjzbe5rlVPz5qhQ9U0cRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694047275, "uuid": "17a4a9b9-ca94-4f36-a5aa-829734c7d41f", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694047275, "uuid": "c31c7acd-756b-4910-bfff-a60121a3a0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694047275, "uuid": "7b28d40b-c537-487a-8c02-2379c9597d88", "value": "d43a14eafc0552fff5bcaa8ef46db8bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f1ca7b-4d46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694067679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067679, "uuid": "b02827d5-c08f-48e3-99af-e3ca13e06c6a", "comment": "Malware payload (ConnectWise)", "value": "67bdf3c0a62532bbeba9a3a95f2b3cd8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067679, "uuid": "04acffb1-e66c-43a0-8fbf-41957d0679fe", "comment": "Malware payload (ConnectWise)", "value": "3a802cefc9627709ac68e229bda3595e657bdf926dde585fd9f606b71d232254", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067679, "uuid": "059e69a9-7141-4c4b-953d-b57b97b3d4a7", "comment": "Malware payload (ConnectWise)", "value": "1f685a491c334056cd574b280693e068ea935e08", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067679, "uuid": "641a0d26-9cf9-475d-af02-49b52171fdf4", "comment": "Malware payload (ConnectWise)", "value": "b3801b9c26a095839134ac8c0a4215ecb52e5489bf7edbbbc87d20939e17d56a656aabeaabd16dd876b2461005e21472", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067679, "uuid": "c626d432-d461-4d23-92e1-4abe75a2734f", "value": "T112D5013136D8C53AF2F61A39E93A91F05939BD24DA67801F43647E1E3971E8096A3373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067679, "uuid": "bb0d64a7-cda1-47a8-b4ec-b9e9e45e4c15", "value": "49152:WUY196CBneXpJwTDVnNe91O+6qShAn4dYdJSQqGOHolFREGxfMnRMDRQ9wl4+KEs:xVm23wTDnO1O+ShhdYdsjG3YQhWGl4s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067679, "uuid": "62ff2ef0-3d09-459a-be19-43f9648b1095", "value": 2908160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067679, "uuid": "cfff73e6-08a2-4a54-af52-c71b48ba24be", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067679, "uuid": "6bc01a56-4012-4716-b3f1-a3e298cca5a2", "value": "3a802cefc9627709ac68e229bda3595e657bdf926dde585fd9f606b71d232254.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb02bbee-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119287, "uuid": "6782e9fa-0bf7-4cf5-8877-f9d4edabc8ea", "comment": "Malware payload (Mirai)", "value": "c687112efb85584676cd7ae5f42db30b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119287, "uuid": "eb9b7c37-e059-4ea2-818c-5c616bab99dc", "comment": "Malware payload (Mirai)", "value": "3ab7c0ec15b1162e830591f009e8bce6e4e472832975e3cee6b3baf7350b15f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119287, "uuid": "6cd4ed62-d74d-4c94-a091-24db9493a209", "comment": "Malware payload (Mirai)", "value": "c442d6da78e2aedabc6d9bd37afa61f0554223fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119287, "uuid": "13353cbe-261c-4e5b-95b2-73eb1f69e6ba", "comment": "Malware payload (Mirai)", "value": "0984db3a64ca041d28afac203d3605f768a61e9ca0e34a30f6d9e2ede33f77f83c524492056463436946da641e9ed66b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119287, "uuid": "cd69b7c0-8972-4cec-9c99-8148798fef7f", "value": "T1A4A2E025BF1DE98FCC37B23886E5E5C692D07C74D29CC5826781C11FABA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119287, "uuid": "45cb77e9-15c3-4ab0-838d-107ef24c3e5a", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtFqDSO:x98o08kxofBE+ZkXaT47C2EpitFGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119287, "uuid": "c4c305a6-1e4d-4632-9a2b-5ba1b92b1153", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119287, "uuid": "b71f2db3-bcc7-4fa2-8c2a-9cf7ce5c6bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119287, "uuid": "7bfeec9b-0cc0-499a-8680-a52a108bb989", "value": "c687112efb85584676cd7ae5f42db30b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6015a29f-4d81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694092855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092855, "uuid": "70fc583e-3e53-4eb7-adeb-f17782599afa", "comment": "Malware payload (Formbook)", "value": "b2aff4034e70921c51bc334135e61887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092855, "uuid": "5e016e91-14cb-4fca-a18d-e484579bfec2", "comment": "Malware payload (Formbook)", "value": "3adb8aeb7691dc238ebd6c61ae7a0f7bdac303f547d02109d5d23bf096403733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092855, "uuid": "89414b9b-0b4b-4686-a78b-be6c029e91df", "comment": "Malware payload (Formbook)", "value": "415f27af2d7de2baec9bea6b4c690005a483bc3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092855, "uuid": "6e022dd1-5220-42d6-aa77-1521f20f16e3", "comment": "Malware payload (Formbook)", "value": "bdefa4a73803fc14bba71373671ca86949ab6bb7b45c768f230de5c6b47c78e2b9460f9a0c268f3513906198936979e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092855, "uuid": "eb05952d-44f7-4fd0-926c-1aaedcd3282a", "value": "T12A7412053A26C0EEDDE31A728979895F994BA11744F8870B6370BF5D7963203980FBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092855, "uuid": "e7ca3dbe-a2be-45c9-8fe5-9f8d98f9fb4e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092855, "uuid": "dcb5cc30-bddf-4bc7-b664-d8bd5d97344d", "value": "6144:/Ya6vFF6nNvLN2DD4IV1ExJzavbbHaFxruTWqrAVSguuRuRn:/YNqnNTN2nyb2vbbHcxraWVueu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092855, "uuid": "fc029d48-8e6e-45a3-a014-dcc64285db60", "value": 368754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092855, "uuid": "2e3c24f1-ceb6-4770-b6c6-bb51fd2aef69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092855, "uuid": "d852b3f5-2c2d-460a-bf70-db13782e9111", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290fa0c5-4d1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694049383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049383, "uuid": "12e113ac-ea6c-4484-8117-49103846f7b0", "comment": "Malware payload (RedLineStealer)", "value": "422b62833d2559e82b52f301ea9e0717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049383, "uuid": "3c330b8e-3833-4c2f-afc6-fe3aa29a54f9", "comment": "Malware payload (RedLineStealer)", "value": "3b3be6ff176f248e367314e5cdd3453faecd79f45a804ed4e132b3e013c1343e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049383, "uuid": "40a823aa-e0be-48d6-8930-80e26f750622", "comment": "Malware payload (RedLineStealer)", "value": "8c26df0d1605dad991ce1111b8f973fd54b95e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049383, "uuid": "14235485-ed72-4555-a0e8-29042cf2fec3", "comment": "Malware payload (RedLineStealer)", "value": "503b9dcafd26bed8f0122345a5d49ca7f9650bc0ac7df440845686eb945c8b5af787104a6944ad9d7d43be286a71c260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049383, "uuid": "b0302667-83cb-483c-b7bd-500b61546789", "value": "T1C5051246EBDCA473D975277058F512870B3A3C605E759BAB1385E8868C732C8E93633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049383, "uuid": "e0c073e2-b699-471e-b0e6-52f2375f6a2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049383, "uuid": "50a6a2e3-5425-40f7-8d60-6cba3a8ffcf3", "value": "12288:iMrcy90lfCHYCEvbtRdm5vvky7n4U+j0YKTcvLzkISFtIKkFQkf+:6ySfC2Tt/m5vvk8gvfvSFwFQkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694049383, "uuid": "d74cd323-dfb2-4028-b65e-01f21f946c02", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694049383, "uuid": "412b9370-e293-4fd1-86e1-7f2f0ccaf82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049383, "uuid": "57279a4e-d2af-4ac8-90ea-c4d1f1e65215", "value": "422b62833d2559e82b52f301ea9e0717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce01d7f-4d3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694063187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694063187, "uuid": "e3a4c272-1755-4743-8894-4e7f53615b59", "comment": "Malware payload (Amadey)", "value": "65cb4f9dfcb2bdef05399b3a91983f8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694063187, "uuid": "494decd7-f4bc-431f-bb22-0947504b29a1", "comment": "Malware payload (Amadey)", "value": "3b7d4cdfc382b166af2f5b381ff8f01f9996bf242c48e083fc20315a79154c67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694063187, "uuid": "cca361e3-6a27-491e-8320-314c0d2c2543", "comment": "Malware payload (Amadey)", "value": "337c3c6e2930c3c110b3bdbd29bfa67a109a52fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694063187, "uuid": "9feeaded-73a0-4bab-912d-ab1219cb4e17", "comment": "Malware payload (Amadey)", "value": "b03b4a634f69ff0e8e5d89b4b19f8ac9ee7579275bff4f5bf6701ea404fd4731957cb0d2b7adda0148c326036c7aaf38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694063187, "uuid": "3fba4117-e491-4da4-a41d-f26f97bb7a3e", "value": "T11D24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694063187, "uuid": "256fda4b-8085-4438-a4de-28696babadac", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694063187, "uuid": "a25426bb-9d64-4107-89d6-68ac00f00f41", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694063187, "uuid": "cb73aca8-eb9c-4ae6-a56e-fa9f2008b981", "value": 225788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694063187, "uuid": "ec09971e-8058-4634-a8ea-2db7eb3bb948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694063187, "uuid": "7f0929ce-e163-40df-b0c3-cbf8386b6d12", "value": "65cb4f9dfcb2bdef05399b3a91983f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79017cb6-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084736, "uuid": "c671eab5-5464-4664-8fe6-51417e153002", "comment": "Malware payload", "value": "2fa2b94fb90233c4ee082fe8abf51895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084736, "uuid": "474cacd7-111d-4805-9c8e-35577bc613f1", "comment": "Malware payload", "value": "3ba23f7cf050c34f1aa8994aa2d2428d6940740c5113133909401fd7862869cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084736, "uuid": "19d970bc-ccdc-42dd-b670-7cc26b73160a", "comment": "Malware payload", "value": "154c52451f23e41cf02cfabf0218faabe1fbdd95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084736, "uuid": "34ab78ea-7756-416c-8b3d-c409c8ded488", "comment": "Malware payload", "value": "c07d4affd1391fa28b603f0392a6386310b36b0b533b1c24427ef17e74a22ebbfc3bde482632ea7bdd3c44e506a8e653", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084736, "uuid": "0bd9882c-f466-458e-8b7b-d052b36d4c87", "value": "T18BA4A30A6E8CA231CEB003BE2D6915F9AFD54BE9A22279C1D794C01F15DFB2406FF594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084736, "uuid": "aa6fea85-f103-43b1-9c94-cf8454a566f1", "value": "247c255d235c944c82ced36f0c8fef81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084736, "uuid": "14bf81c1-ed61-4c95-8e10-a405740b5fef", "value": "12288:OjKSZhnVepH18HxMeq5RJ51OGT0T7spksySxDlYJKCHV1fPlizK:OjRhiH18HxMeq5RJ51OGT0T7spksySx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084736, "uuid": "7cc00bca-a404-4d7a-848a-60ab29eff9b6", "value": 488412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084736, "uuid": "21daef2a-8867-4089-9a1a-34ebcaaa8383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084736, "uuid": "c2c7da17-949c-4a5d-a88a-1c559d768850", "value": "Trojan.Autorun.ATA_virussign.com_2fa2b94fb90233c4ee082fe8abf51895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f484632f-4d48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694068623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068623, "uuid": "5f103c83-f8de-4f30-b0be-44276524f252", "comment": "Malware payload (Amadey)", "value": "8be1cdfbfa7664ea28db9f7cd51b88f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068623, "uuid": "f77584e4-5f49-43fc-877e-d2c3e666d8ca", "comment": "Malware payload (Amadey)", "value": "3bb34b2c42f2940f7ddca6380789f30aad86375c842b634801c1fca174ea5f7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068623, "uuid": "dcf4016d-76cc-458d-b1fa-1ad25e0059ef", "comment": "Malware payload (Amadey)", "value": "86255f2501b277173e532cde7c5a9b271d05bbea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068623, "uuid": "7bea12e0-d8b9-4042-ac93-8c088aefd6ae", "comment": "Malware payload (Amadey)", "value": "8f8b9dc89e90fa95784f8dd151ec58a4cbaccb60c911f528960fcee3bf6d675e1c20c06400aa7740f526510ffc64c41d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068623, "uuid": "f484c7a0-c1bf-44cd-aeb4-6a0e26a7c469", "value": "T12AD41242EADD8427D8BA3B7058F647830F397DA39C74436E2786585E0C73A81A571B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068623, "uuid": "ea6e99b0-8f20-4e57-ab4d-f8076708a0de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068623, "uuid": "d0f92ce1-caf9-4ede-b1f5-3066488fe1c9", "value": "12288:sMrQy90N9odjduxAX+Rr3PIic56Op6ehN/w0d3d3M2m8QM/ifMxuX:0yK9PIJ5NhNnd3Jm8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068623, "uuid": "04b26d5c-c573-438c-aa6b-a2d4f64eee20", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068623, "uuid": "0a72f8d8-e926-40f9-aea3-89c7b1cc6801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068623, "uuid": "03c6b6eb-2898-4e0d-8666-e32aa26aa515", "value": "8be1cdfbfa7664ea28db9f7cd51b88f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82908ee-4d50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694071930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071930, "uuid": "1bfe3ed6-e273-4083-ae51-cc0086413f9d", "comment": "Malware payload (Smoke Loader)", "value": "c93c113706ae70839e819c526af74aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071930, "uuid": "2d6a8124-3ebb-41a0-a99d-cbd244f9ed91", "comment": "Malware payload (Smoke Loader)", "value": "3c4dc1fb66462c6e88eee92222d1c2b4176d71c2be8dd85967cae346c2904d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071930, "uuid": "375cfc69-80dd-4c11-a7d9-2b63d76ea98d", "comment": "Malware payload (Smoke Loader)", "value": "fefab33a4be15be70384377e64eba6f836b00882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071930, "uuid": "d69bdf93-223b-4bed-8106-ad2eff75b17d", "comment": "Malware payload (Smoke Loader)", "value": "89b7cfb069559746a9bfd6bed6f44e9dd953384426e57a475942fa1210f6222ccd14bda5b6aea9d28b5216517f001c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071930, "uuid": "8da6077b-dfdf-447a-a56a-3553a5da0be3", "value": "T1B944CE2272D1C077D2A352368AB1CAB55F7BFCB19B6155CB2B941A3F0E747C08A7434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071930, "uuid": "3d4cd837-c012-4597-b88f-6ba6046d0fa5", "value": "b47cf3c5038ad34425cf7f361b3395f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071930, "uuid": "2a945cf6-4666-4428-ae3b-01d121376278", "value": "6144:B1/vZbWuwF4hKN71NtiX1O95jI0M48IPdn:BN5W5mhs71NUcrU0fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071930, "uuid": "8aa32f65-9cb2-49c9-bcf5-37dfb5e94653", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071930, "uuid": "0127a9fe-254c-4565-ab71-18b700395748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071930, "uuid": "24ed3b38-2d95-4598-ba45-c28a066bdc68", "value": "c93c113706ae70839e819c526af74aea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc27ae63-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085305, "uuid": "050a9cc1-7e05-4cc4-968c-4c6652348f07", "comment": "Malware payload", "value": "0f8e465c3e72154c37148d67ad2f974d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085305, "uuid": "5f9ece15-5aa1-4fcb-92e1-7a8ed071a345", "comment": "Malware payload", "value": "3c5fbaa54f57c6aa504ada30ad5b069eebf797244a61b84c518f4758f8fa5ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085305, "uuid": "af046b5e-e382-44c1-abb5-1aea00d35c1e", "comment": "Malware payload", "value": "ca35fa01ffadd38d8e34ed6fe7a75c170617cab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085305, "uuid": "52c82ca4-924e-4c5d-a401-8a1e0fc2741d", "comment": "Malware payload", "value": "979dda039564a8f47d5bd9e198ab714b1bc7cf065ae46b775a02bfce2a0b9885d21fd7944a73a3ef552d58ca0cae0c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085305, "uuid": "87c63864-2108-486a-a1ed-97403e5ae12e", "value": "T175D40912222A8C59F290D27791618BA2FD705F862CF2C503FABD7E197F30B534EAD519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085305, "uuid": "3c450d50-3bc3-4eea-b7dc-094c6814cff3", "value": "d3cbd6e8f81da85f6bf0529e69de9251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085305, "uuid": "f4576c9b-d409-4e5b-a425-7d414b8b44f3", "value": "6144:FqDAwl0xPTMiR9JSSxPUKYGdodH/baqE7Al8jk2ju:F+67XR9JSSxvYGdodH/1CVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085305, "uuid": "89ba93d2-c7ce-431c-9541-3f34f0ae4cd3", "value": 651548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085305, "uuid": "9de3e7c0-bac6-417b-97e5-4235ea0b2cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085305, "uuid": "80180a43-0105-4d1f-8456-1bc9f84b301d", "value": "Trojan.Autorun.ATA_virussign.com_0f8e465c3e72154c37148d67ad2f974d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73daeb46-4d89-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096324, "uuid": "cfa2361f-9714-4959-9bcd-7d1c40fee4a2", "comment": "Malware payload", "value": "ab8953c607c268e338e4dbed82617245", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096324, "uuid": "d0afa248-9baa-4792-aa72-544628ae1a0e", "comment": "Malware payload", "value": "3de650c4589cb5c6d1b1b94e60570bad68bed634ed0dd185c0d7f1d8f3cd0548", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096324, "uuid": "df0cc659-b66e-46e6-8147-b900c57ce4be", "comment": "Malware payload", "value": "234f53d70517d18c60e6d99b07aa1157334aaae4", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096324, "uuid": "166e6eb4-f719-4d61-8dd4-787878eb2442", "comment": "Malware payload", "value": "c16b54301ae9418f58010ea5ec23ecb8fc32da027cbdaaa202475a22573171435eb4d6473e5cacdda25dc6def9c18499", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096324, "uuid": "a8290975-4f8d-493e-9bc7-5de17c5714b7", "value": "T15541A8AB4392317BA3F2115697857007E99580CE5C1B39047BDCF55FE7C132643A7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096324, "uuid": "a4e60af1-1ae0-45bf-9ba8-6a89830a56d0", "value": "48:rujc+yjQqxjSvb29XY2CQpScoQ+JwpAikSE09TZOU:roy3YT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096324, "uuid": "ef75f4aa-593c-4eb8-908c-45d23290bcdd", "value": 2099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096324, "uuid": "c09aa135-f1dc-4dab-a542-c0e8dac17045", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096324, "uuid": "a4bf7499-e66e-4434-9cfc-9a36785e9b5a", "value": "KDZR0g3c.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cb4e39-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075735, "uuid": "a1e8b1c7-da38-456b-a9ad-e7b70496f726", "comment": "Malware payload (ConnectWise)", "value": "af16bdbcf8352cad989997a89ff8a7df", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075735, "uuid": "56c935f2-7a5d-409a-b90f-8b73c304539f", "comment": "Malware payload (ConnectWise)", "value": "3df106194f21f3b2d58097b85ba3912f9d381ba69e0c9ceb15e9498c039f322a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075735, "uuid": "f820516b-a5f6-4b78-9bd4-3e1e4ffd68a5", "comment": "Malware payload (ConnectWise)", "value": "3463ed16999d45b5628f2cc397c24fa634ce8f6d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075735, "uuid": "1c993a44-ff26-42c9-b42f-666364bc103d", "comment": "Malware payload (ConnectWise)", "value": "ce04f4da2b3d22a5904bb4452fb41a12a9e278c24c2164f30d7e6395b07a58ec27fb3fe9ff42da5e00c4ced1d191454a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075735, "uuid": "4f797cf7-c016-4fc2-b624-089392d22aa4", "value": "T1E5835B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075735, "uuid": "8c10b824-5b7f-4f96-96c9-e6f049adeb25", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075735, "uuid": "35171305-0df1-4dd2-a4f8-d1fc5c4b4cf8", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Wk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075735, "uuid": "26c5a6f0-5604-48ab-9cff-bad645aaab1e", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075735, "uuid": "9b8036d8-2a34-4ba0-ad80-aff16d928bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075735, "uuid": "7cfde6ff-9503-4118-8b01-00f6d8021b3c", "value": "af16bdbcf8352cad989997a89ff8a7df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5485ee-4d77-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694088770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088770, "uuid": "f0e3da17-837e-4256-acf8-f5d2e9763868", "comment": "Malware payload", "value": "82009f7a1f50a48de52453bb4e061959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088770, "uuid": "036987a3-e4ed-4b4c-af81-75e8a9cf267f", "comment": "Malware payload", "value": "3e78cd4e2dcd7b08a7682e31edefad03a659a413ae23018204f9461a6b44c422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088770, "uuid": "c43dd598-ad55-466f-a7ca-78fc50ea80b8", "comment": "Malware payload", "value": "0b2c3f650a8cef7fa8f54c0a0d8df2fa42675a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088770, "uuid": "f3f7c459-749d-4c07-953c-253e0bcce1ed", "comment": "Malware payload", "value": "53eba3ac60bb695a88ad7c4a9751a400c95dc52a3e274a4124a6d524fbaa6cff63c30d29cbcb095401b9968b2ec9003e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088770, "uuid": "b5ec820d-f419-4a7e-8c33-4bf199229188", "value": "T15ED3CF13B790C856E0244A34C893D3B94BB5BC14EEA543A336E47F5FECF7294AE21A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088770, "uuid": "1be78e20-6341-4ed9-9cc5-bb355cb81504", "value": "64369b902be8b667b461145ef39ae6b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088770, "uuid": "dc3ca9e3-8aff-4d58-8fcc-2a697664f2e3", "value": "3072:/taoHTRyhoAScL060gorCr04r1RHrvnTEMRPOyCHklx:0uTaGFgo+LzvYMB3CHklx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694088770, "uuid": "7760d615-c3eb-4032-b3c3-32abeca02d0b", "value": 142200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694088770, "uuid": "362ea5a3-dcb6-46d8-9891-b7c5bcf7ed48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088770, "uuid": "95b5e593-bc82-4cef-bb5e-09758e0b8b36", "value": "3e78cd4e2dcd7b08a7682e31edefad03a659a413ae23018204f9461a6b44c422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9318f78-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694084871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084871, "uuid": "17bc2811-91cf-45d4-b84e-f04cd7d28a07", "comment": "Malware payload (NetSupport)", "value": "76c8b3c3cbdef2765f41dba5fb8ba429", "object_relation": "md5", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084871, "uuid": "cbd72156-3161-405f-b749-40aeda67c50f", "comment": "Malware payload (NetSupport)", "value": "3ea2698147e76352dd8982b0fda8b1652f8c56ab4ed7e77bc3261cceb3d8f134", "object_relation": "sha256", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084871, "uuid": "77884429-b9a3-45b5-91ef-531bbaa66c47", "comment": "Malware payload (NetSupport)", "value": "75dcce445df5618982b0cb94baa08b714fcdde9a", "object_relation": "sha1", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084871, "uuid": "09a27821-34ea-44bd-a1f0-c2b99b01dc82", "comment": "Malware payload (NetSupport)", "value": "0b3555ffbb541645660eb8159ca6c3803f535e2a4b3914acaa6f4afa0e050dda276cb96816e90fa30f2ae8cd2721d5f6", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084871, "uuid": "91e81ee0-e104-4b67-8090-48caae758a9d", "value": "T11DA533134B329DC4E423327B6CD67A30BA7E9336BA627E6CC156C68720D9DD6C96CC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084871, "uuid": "26745bf8-9ad5-4f09-a49a-3a529accc250", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXAH:OVtEgPdiERqpWvMOODPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084871, "uuid": "7a55a1e5-3a10-4e2b-b7a1-a768b4369b79", "value": 2191256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084871, "uuid": "dc25ee35-15cf-4d56-a561-3a1382a7222c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084871, "uuid": "95356ede-a515-4056-90c2-465714a6f02a", "value": "TempPlayerMediaContent.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7ec389-4d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069070, "uuid": "2aa15bdb-e84e-4400-8969-d5e62d47c5c1", "comment": "Malware payload (AgentTesla)", "value": "5900e167df01aab3c41c691bff35b745", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069070, "uuid": "c0d9d660-06ec-45b2-847c-8d15e9c60c8b", "comment": "Malware payload (AgentTesla)", "value": "3ea30252cf20d5db927ed45f477a20c02a6ebe21f052b778c9868cdf17b42b38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069070, "uuid": "8b88dbd7-ae3f-45c0-b649-83cba6e5aedd", "comment": "Malware payload (AgentTesla)", "value": "e67a2f6607da4aa525a138a9494d69de9bac1750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069070, "uuid": "2d7a552e-a2a8-456f-8eca-6ffe909f66c9", "comment": "Malware payload (AgentTesla)", "value": "8e26f7970cbd48d9d56c34cc3df7f87b0e9a3bfbbdd5dff5fdf3c3c6f173a9b1427d3a75a09649bee681f13760e10d12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069070, "uuid": "945eec93-73f0-403c-b17f-c881861c8c11", "value": "T1F0D4220552911FB8DAE1C3F70166285A5BFFAA841064D74C1ECBA3CECB74F6142A39A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069070, "uuid": "a998cb89-319c-4234-8d94-c49c3be14196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069070, "uuid": "7a038545-9767-4308-9181-11ad6ccfd721", "value": "12288:7lgQ2x7Ds87oTHm5QluW5ml4Bl2ErIA6wRBK1G/Tt5fVsbR:7y3xMchCluyS02uNF/TttO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069070, "uuid": "14909216-39a2-45fc-a0be-0f3f2e0bb289", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069070, "uuid": "16f5d11b-a93a-4983-ad06-d765a90e8f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069070, "uuid": "e84115c7-c2e6-460d-b1d3-694d426ddd47", "value": "DHL Express Receipt_ AWB#20448299082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235d10b1-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103061, "uuid": "1e6f5c68-8f74-43ba-a748-52c5208a04c5", "comment": "Malware payload (Mirai)", "value": "25226073d58663e789c1e661e46fd33b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103061, "uuid": "e69a6a77-4a7a-48c9-98d6-bc3fab7c81c5", "comment": "Malware payload (Mirai)", "value": "3fa091550010a257924a3de60a289ef179f0a7c5ed2127e86f83dac052960bb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103061, "uuid": "9686deb8-e879-4273-add9-ade3be7a19df", "comment": "Malware payload (Mirai)", "value": "97e8cd2b11203187bf70db7519166932fb613ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103061, "uuid": "6292273a-f1e3-4fef-8f44-e127cced4435", "comment": "Malware payload (Mirai)", "value": "4b851e1a9be3c035a7c405e88ca6a71333cf4addb024c4e10694f371bf961add38404dfb452bf176f624e73a4806ffd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103061, "uuid": "30d615c1-04bc-4f3e-af99-ac43f2726dc5", "value": "T1D3535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103061, "uuid": "e9784b5e-9fb7-4fac-8a5f-091d237d038c", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8K:N1GjR8EVGOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103061, "uuid": "609f2c88-a7d9-44d9-a8b2-6db59604b3df", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103061, "uuid": "b0d8ba1c-4659-4a8f-add1-6a06faf7bf40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103061, "uuid": "2aba2634-f241-49b7-932d-f258a4c2d832", "value": "25226073d58663e789c1e661e46fd33b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325ac1e2-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694081182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081182, "uuid": "4868e048-3608-4f19-bcdb-241c9f34218a", "comment": "Malware payload (AgentTesla)", "value": "2353090ee9963d8c00359240e1470981", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081182, "uuid": "145fb7f2-d656-498c-ab6b-78150829c6b5", "comment": "Malware payload (AgentTesla)", "value": "3fea1e268dfa85d03f33756bce11c776296a8d1669f4f594529c29856922c5c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081182, "uuid": "6dd800db-c24b-47e4-9a49-d8b7a035a02d", "comment": "Malware payload (AgentTesla)", "value": "bef7e48a5389e1cdd672c2f6a39492097d0e097b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081182, "uuid": "b82b28ab-cc5f-4422-83f7-fdd57efc8c9c", "comment": "Malware payload (AgentTesla)", "value": "bd1cd29c2921492622adffbdfb9136444e0f59cae8bd4cc2273faf2ced50712b367563f11168422703579c212ad8b581", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081182, "uuid": "279741cc-1a4e-4058-b46b-1249db289578", "value": "T15995B8037B468BE2C1B9D736E3A7041CA3B5E8812333DA1A758A13694DCFFB65865707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081182, "uuid": "43a90a7f-e4ae-4f3a-bf88-22fe829711bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081182, "uuid": "5e7144c7-4c71-4bf2-bf1e-bd771b079df6", "value": "24576:NE9aJy+pm8/udsDSAyBMjozajz4xitqiFqa:e9pwmsDyCz4xitqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081182, "uuid": "e7321031-4ffb-4f74-8811-6ddd1876d67a", "value": 2003968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081182, "uuid": "97b3168b-1fad-4d49-9329-037b84af9dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081182, "uuid": "2d7ed922-7232-481c-93d6-6c1a47a1685d", "value": "3fea1e268dfa85d03f33756bce11c776296a8d1669f4f594529c29856922c5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46887fd6-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085081, "uuid": "caa8c1cd-66cc-4057-aa11-739baf6e248a", "comment": "Malware payload", "value": "cd97a53fc8071e00625b4d9bc4ef5c4a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaca", "colour": "#BB26B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085081, "uuid": "a4e61821-d07a-430f-8512-8006421b087e", "comment": "Malware payload", "value": "4099830655dbc477365fca2886698ac9d2581b3e4b332aab7da277de0b16f090", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaca", "colour": "#BB26B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085081, "uuid": "b0c60783-8aa0-4761-b17e-dfdd8faf8ec0", "comment": "Malware payload", "value": "50a61c73d781f1dc930c19b23799f9565d3c8a4a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaca", "colour": "#BB26B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085081, "uuid": "27133f86-0a15-43a4-af78-e796e8271bc5", "comment": "Malware payload", "value": "7bf8a2c65b07000170b14472cf58e90bafe70c7219f940658932d91e99641e822725f9092eecabb8329db778a1e63628", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaca", "colour": "#BB26B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085081, "uuid": "40c2e702-a5f2-47da-8e1c-23b58105407b", "value": "T140944B36A269007CE0ABD1388847BD06E679788783F19ADF03E495761F63BD49E7E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085081, "uuid": "92677f4d-6426-44de-a2a4-88c59cc6ec0d", "value": "c8559a5d624682baa94c171b643d7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085081, "uuid": "985d0d19-2617-4639-9bd8-029ce8917064", "value": "6144:7qB3pcecbY8fYtcenTsVV5DaF5Ex9/WnuTpsU3iNrcflvfohDG1DOvlwbH:7qB18fScUTsVV5DaUeWsUgq3o1G4twb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085081, "uuid": "8119dbfc-5428-44d4-acbb-0109af5e3af4", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085081, "uuid": "bb124cbf-a762-498e-af4e-bba155d79a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085081, "uuid": "89218606-c0d9-404e-9510-dc24b9678a3e", "value": "updates.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd42564-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122141, "uuid": "d66271e3-026a-49b2-81f0-5834de7e82c3", "comment": "Malware payload (Mirai)", "value": "6510c9d3ed0c2db9d58bf14a36de3193", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122141, "uuid": "04035b4e-1d7c-4a99-a951-796436000bc8", "comment": "Malware payload (Mirai)", "value": "40acf61ebba6e3f33df743b0036b5f5df35ea7182a75e0442e90f6af409078c1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122141, "uuid": "26c503d6-3321-4b8e-93bc-98ac5aab6200", "comment": "Malware payload (Mirai)", "value": "81b1b2c182ced2dbef97495365ddd8ade2f61c61", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122141, "uuid": "52cd3b62-3981-47b2-9950-fc57b1d09d7c", "comment": "Malware payload (Mirai)", "value": "b0029c0f779b6826bfa4d1c4fd12af864c93937b405da98302852da1adf179ec929c5cfa9ae93c7a293ff7f597af4725", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122141, "uuid": "47f212b8-b01a-4d49-8936-57d276b9bf47", "value": "T1DBD2D1EB65BFF277C075B874306011C4FA383617E32D5B6B08EAADA855F66802710E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122141, "uuid": "e59ad824-e7b7-47c4-8596-7b544141e44f", "value": "768:DYSoXdJZ5U05VxmHSSc+H2c+lPDvSSx0sc:DYJdJZ5UQVH/+KDvFtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122141, "uuid": "96f25488-074d-466a-a3a3-fcbc2c98e917", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122141, "uuid": "2c8ba635-01d7-4aba-a594-619ab7a7b7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122141, "uuid": "404b089a-3430-46ad-a811-acae7635db45", "value": "6510c9d3ed0c2db9d58bf14a36de3193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede5e7f9-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694090086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090086, "uuid": "8050a121-d353-4513-afdd-2329623d202f", "comment": "Malware payload", "value": "38b2af365b506ade1f37014f47822f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090086, "uuid": "39fe0700-2554-4572-95a2-0facc322d646", "comment": "Malware payload", "value": "40f051ea4327b1ccd142987fd794b0210e17a343147b6f6d99cdd605ff47a23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090086, "uuid": "c3f09900-76d3-4b44-b964-25fd0da97012", "comment": "Malware payload", "value": "ec0c1d4c8dc9b6e0f65b840788c0588262b79526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090086, "uuid": "3dfc7334-636e-48bc-b4b1-70c209a711fe", "comment": "Malware payload", "value": "d6b69add3711154e00a9371c4f25e16b58caac954d8e609b6618ed7779271a385ffc0487a84cfd79a0ede2c401acdffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090086, "uuid": "0d165af8-5f97-4afe-bb84-a8d6ca4c250a", "value": "T10E16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090086, "uuid": "42f23a2e-4239-4649-85a6-7464a2d04521", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090086, "uuid": "6be7bcf5-5770-4684-91ad-3cb1f87d5d4d", "value": "49152:tgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWAjXNO:Za71fkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090086, "uuid": "98c67437-7573-481b-aa4f-30c94f2946f0", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090086, "uuid": "51cc3e8e-1917-4f99-8d10-aba8df03e6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090086, "uuid": "24cc40e7-2788-473d-9d50-cd77036816d1", "value": "SecuriteInfo.com.Trojan.Win64.Delf.30173.22604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad26067-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127689, "uuid": "353b43d1-a336-4538-a2a4-70fb8e887d4a", "comment": "Malware payload", "value": "27bde69142a9aa3b830fbb3e5aaebae4", "object_relation": "md5", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127689, "uuid": "ffbc2ad6-87cc-4483-afab-d6f54ac37835", "comment": "Malware payload", "value": "41a652807b0e7c4b8c726fe70850c57b0897da1c96a105dcdb48a76566f434b9", "object_relation": "sha256", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127689, "uuid": "45385e42-3b44-4887-921a-7e534513279c", "comment": "Malware payload", "value": "466cf261a0db3546bc446975f80ebfffbb5ba9d7", "object_relation": "sha1", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127689, "uuid": "4822b93d-6bb1-48c1-bf1d-d2c1f5068f13", "comment": "Malware payload", "value": "e93124f08e0f6e8a42f051b58bb4eaba2fffab3764346c74b865cc4a2fb8547712a1f4468fa08b3d1780a1e5cc4daa64", "object_relation": "sha3-384", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127689, "uuid": "1ddedebd-ebf8-48b5-a797-42511eb5308f", "value": "T19231850FE10F42B9EB8652C2F5946C0EDC44984FA606BC79B6F883C0AF260B1834F00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127689, "uuid": "7d3dfc2b-3806-4088-ac62-6b47c4a75417", "value": "48:flIQT+ftt8UEjCY41Fc05GKWUEk7WYYlaVcmDt:flIISpQCYmcMGKfEcR3Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127689, "uuid": "3620047e-a81f-4306-b6d6-b98063799158", "value": 1781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127689, "uuid": "77dfc162-2089-4379-b0e9-1235bff68caf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127689, "uuid": "70e0a970-2bff-4b55-ad07-1fe90c9a12a2", "value": "kin_mix%2Bnotion%20_new_21.08.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc29863a-4d21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694051778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051778, "uuid": "4b3b4d68-ae18-4e71-8347-15cadf1ef249", "comment": "Malware payload (Amadey)", "value": "191a6d966d273b730b20c71f47c66a9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051778, "uuid": "962a7b32-61b4-4b2a-a8c1-932d3d49652a", "comment": "Malware payload (Amadey)", "value": "41dcfa71a8b2bfc81f2517f064f47d72e8131284e4202fdd72e0b19192a0886e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051778, "uuid": "ec518d67-1821-4857-a57e-ff3a97597d45", "comment": "Malware payload (Amadey)", "value": "e95856c6fc5eff4fd91a3f050c74ba3028c16ff4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051778, "uuid": "d9209ddc-2299-4e78-bbeb-a5cde2c05bd6", "comment": "Malware payload (Amadey)", "value": "bb7e5a932140918dcac72097807fb317a692ac7f1c7868cb3d3eb9e5158324343a845b5b08afb75fc4e48024b88771da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051778, "uuid": "70e6232c-3488-4737-a168-664e422bf12c", "value": "T17324F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051778, "uuid": "ab4ebada-2cf5-40e0-8f06-4347dfec4002", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051778, "uuid": "f1b50e27-f309-48c0-a581-639efde002c3", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694051778, "uuid": "94404ebc-83cf-4a04-afa6-3fe48115954f", "value": 225560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694051778, "uuid": "337ffc6c-651a-4bda-aaa7-a9b74297641d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051778, "uuid": "d995a075-1f07-4159-b0a9-86dac541a450", "value": "191a6d966d273b730b20c71f47c66a9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae1d396-4d5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694077062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077062, "uuid": "a06c5298-28c2-4960-9c3c-d5778e1a7962", "comment": "Malware payload", "value": "415291c5c3059fa97c0e80cba716b948", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077062, "uuid": "356237d9-36a5-4615-a034-c5762070df9f", "comment": "Malware payload", "value": "429a498effc99a5ee9c28ed80a6e3b061734432da6ef5af325ea0b1620d30ecb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077062, "uuid": "3678081b-754e-4a0d-9833-cdcea5971fa9", "comment": "Malware payload", "value": "fbe0c3ce1cd60594c9a72df17502fe7b55553bb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077062, "uuid": "7aabe3cc-dd12-4b9f-8b6d-e3113e5d6980", "comment": "Malware payload", "value": "9e1b5a0227c5e1e7538e8e2862e72a5f4e1f781635ff89a86ed26efef68d6aa203a6df9c9a73cdb6f5bc795f00dc7911", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077062, "uuid": "2490ac02-d74d-4578-9c91-26cc8889ef80", "value": "T1DEA5330E169AEA38ED563CFF143D6ACF8A6D29613EF0D09B5C44061ADDB27525FC4223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077062, "uuid": "66bf8b7b-4608-40a9-93d5-b9eb83cd42b5", "value": "ce2b1b9ebf14c707c66cc49f86d7f50d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077062, "uuid": "0f38dddd-c613-4e31-9fda-edb4c457a51f", "value": "49152:bgvg8jEnU59nP2xrk6i1njWaPwbul/wIknfwpANW:sTQnU5NPazi1njabg/3qIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077062, "uuid": "4e9c10b6-bae3-4888-b0b1-33e3b802c755", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077062, "uuid": "2d7a30ec-025c-4baf-95b2-a77a838e2987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077062, "uuid": "433987d4-1d40-4174-9d20-c2171ebf01ba", "value": "415291c5c3059fa97c0e80cba716b948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89f3d71-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103768, "uuid": "93f493a1-9843-409e-bad6-4dab98c5f4d1", "comment": "Malware payload", "value": "be99508489c805cec538eeea24386284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103768, "uuid": "d601e70e-1a08-49e3-a47b-e7e401a1583d", "comment": "Malware payload", "value": "43c7be1300ee7bb7ce2c317ca2a38735f339542e1addc521150c017d6cf598e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103768, "uuid": "bfbc4a28-5e62-49aa-b7e9-be55268f428d", "comment": "Malware payload", "value": "128a404c4004259ccce710c002f92852376f4153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103768, "uuid": "67ec02f9-bcad-46b0-b3b7-a286c5e9749a", "comment": "Malware payload", "value": "9ee4da1e66edfbc3461268539c7c63f3b7cbf7f1cc194ca4c3ad52d51f307d0e96cb2d1e749ff272a05a5be88424a7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103768, "uuid": "a3518f33-5e21-4ffe-9483-4e4ed60092eb", "value": "T1A4552312AAF99677E5B06BF13E1D855A073236117D312C4CDDBAA6C6BF3B1806830787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103768, "uuid": "c9988e37-5939-492f-8416-7deaac476818", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103768, "uuid": "d3b01247-bf41-4798-9dfb-f881a5e4012d", "value": "24576:mI39dQU3uK5erMLMhKzeY8T+HXaw881s9fUHm8fSoOpzzsgqF5ihgebVKoyInpD:m6dJb5erMMhKw6ns9MHmAopzwgqv4Vbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103768, "uuid": "db830135-6bc1-4e23-8203-b941951ab3ae", "value": 1283180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103768, "uuid": "ca9903ad-7801-4f06-8171-ddd6012d3242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103768, "uuid": "2a84b61b-af66-4198-88fb-ac7b3407a491", "value": "be99508489c805cec538eeea24386284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3285af5c-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067868, "uuid": "996c595e-92f2-4a52-bbf6-70d46fb15cd3", "comment": "Malware payload (SnakeKeylogger)", "value": "9c87081539047fd330025e8ba49c5271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067868, "uuid": "81017443-e54a-499b-a83f-c7ccdbc749a4", "comment": "Malware payload (SnakeKeylogger)", "value": "43eb866933b7c13c9e6609555aee1520b8138f6a1bcb1295b98935a323936cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067868, "uuid": "bc06f020-d858-4742-97a5-a3361637193b", "comment": "Malware payload (SnakeKeylogger)", "value": "d85cd6fa6d8b5b2968ae93c5efce25785081754d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067868, "uuid": "bf3d8f23-aff4-45b5-a775-e8993779e5eb", "comment": "Malware payload (SnakeKeylogger)", "value": "2641c866451ff563d8404debe743b58803c9042c40ab993e8a51012b07acd740ccc18580732f217c996f7317e2e0dedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067868, "uuid": "1576f26a-b354-4502-818e-606d5ab25f54", "value": "T1D32563FC5CFC1136D9A0EE908ED9851BB1C0A17FF285AC1D97E20B654252A4AF88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067868, "uuid": "b061395c-e17c-46af-950f-89c0f7df1eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067868, "uuid": "55258b74-3fd1-4a91-aede-f1600b3f6174", "value": "12288:QItaEJeq4bq7zko0Vcjsrm9EJHZuawZ9AhXse59BrXB7HIF:QcXePmwoBsrHiAhXsevBrWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067868, "uuid": "f876c645-1f6f-45c3-9bd5-40142bbf4eb6", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067868, "uuid": "11e1daec-8aeb-491f-aeb0-578ae1c5b966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067868, "uuid": "65bcd66a-83ad-4955-83eb-e82f4b681f4d", "value": "Current Price list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821974e4-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075303, "uuid": "0c525349-35bf-4ffe-b902-aa8ecc2c7649", "comment": "Malware payload (ConnectWise)", "value": "d2e0cd954d263120eec5d9a4ed5982aa", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075303, "uuid": "d7545794-6d32-4ee1-ae58-389155c8ce2a", "comment": "Malware payload (ConnectWise)", "value": "43f7b5da7325dbb81a88d0fcdfcac24cb0c8e71d34a32d2cb6964b789de83f44", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075303, "uuid": "be5a66da-8965-47d8-955c-25d51e0b4d58", "comment": "Malware payload (ConnectWise)", "value": "c3fc1b42f5ed243f75bfe3647187c41696900004", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075303, "uuid": "66c7cc28-ea89-4a71-87c3-288ed23c16d1", "comment": "Malware payload (ConnectWise)", "value": "6568d6381cfaf90ff12c92945b6708acfae97df1ee9666350b9b8339e8178fb1c61ebd2d86ae0342d007b6439dc29705", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075303, "uuid": "b8ec1b2b-d721-48ef-aff1-d921e474281a", "value": "T114E5122237F98539F2F71B35ED3A91B05D3ABC249E21C11E5364790D1E72A808AB6773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075303, "uuid": "3b9d0dc0-581d-412f-b6f5-7d67bc8ce295", "value": "49152:dtzP/DQtSwBLlw6f4H7GxIcrq6x4dYdJSYG6Kk2f2gZgBZgQfpN31go:P3nWn4bGbq6adYdsYGLPygQfpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075303, "uuid": "f910568c-40e8-465a-b4c8-4d8d685f1b40", "value": 3059712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075303, "uuid": "566b07ee-6c05-4e8c-832c-54280470b495", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075303, "uuid": "90c71b45-a0a9-4bf1-99d3-ea5545c404ec", "value": "d2e0cd954d263120eec5d9a4ed5982aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aaa56e-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052386, "uuid": "51bca0ac-bc18-4fa4-adad-8a0c09151956", "comment": "Malware payload (Amadey)", "value": "bbd7866242343b6a9982e7d5b5223278", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052386, "uuid": "3db2bee6-9e98-4ca3-8299-cb32f331acab", "comment": "Malware payload (Amadey)", "value": "444913df19d2aa88476686839fa7c301fd9e4a77b427cd2049db67aaa0047115", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052386, "uuid": "2d03bd89-f83a-4cb0-98cc-12de9980176b", "comment": "Malware payload (Amadey)", "value": "7a0b7c08b793c7d84fb15bf2e541c4c300364dbf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052386, "uuid": "93ff1839-166b-4818-bc5d-c927391405d3", "comment": "Malware payload (Amadey)", "value": "b7fd69a99ad619edb57aee7976db54f3de08bcc3716309d73dca112d4a15d51525e914447d273296b9a96e902be2f814", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052386, "uuid": "fd683671-1b98-47f1-9faa-e52ee13a7d77", "value": "T14824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052386, "uuid": "16799aa7-f47c-4bdb-bc41-7726c60d6d34", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052386, "uuid": "9b78bd96-e797-48a2-a3ea-40700346e8b1", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052386, "uuid": "e6a8f1aa-6fbd-483b-bb86-a250997b808f", "value": 225513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052386, "uuid": "e3488aa3-3432-4312-a261-8d5087f465be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052386, "uuid": "32811e30-2f6d-4aca-bcc8-ae43e23ece4e", "value": "bbd7866242343b6a9982e7d5b5223278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c530d6b9-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096031, "uuid": "26263f37-5827-41f3-bd28-5b5f1c105f17", "comment": "Malware payload", "value": "05f2f9d8209fe6a3320e11b3c5d5e935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096031, "uuid": "18da19d3-ffd7-456d-a27d-4bc9d97816fd", "comment": "Malware payload", "value": "4469f6ffa74b44be7e6fedd8d45d13917c58052f5e045b21afefbc5a2f71e5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096031, "uuid": "2d1f5066-9c2c-4534-9cc5-695dcbeb7b49", "comment": "Malware payload", "value": "bf86c8f0f8db7055822d474015947462157a67d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096031, "uuid": "de5eb597-abdf-4ac5-aa21-25e1751a423d", "comment": "Malware payload", "value": "dd2649e39f5e8b78293641a1996d581d71e30ae959a56724f4579a05b9c4820cf2097b2f126d782a8c2b065772db7c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096031, "uuid": "57c707a9-ac69-4258-94f8-ad0b8ee181ed", "value": "T18F747C1377A8E93BD1BD577AE43606054BB1D403BB16F38F9A5896B92C233869D403B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096031, "uuid": "5cfa1a7b-14aa-4197-bf83-27af85cbcd0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096031, "uuid": "5ccd288d-b333-4b0d-b8de-12eea3803d38", "value": "6144:5zNHXf500MubGpz0F0RFNusb3C7tfWEabCsji9eG:dd50T05eydpabCsiAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096031, "uuid": "d24c358a-33e2-4b8e-81a5-55639e74449e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096031, "uuid": "3e68537d-47c2-4893-b3b7-77b1e6d991d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096031, "uuid": "bfd2a280-be73-4fc6-b0bd-981befddf5b8", "value": "decode_6c4c62747fa33cb347014f0c3db2f94891cf5ca510b01a2df828d60e9f19b3e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb05ddc3-4d61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079371, "uuid": "b91ccb17-8fc9-4735-822e-e4f4d88ca1cb", "comment": "Malware payload (Mirai)", "value": "ea8ee8a3a67c7cd2994788fde8231e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079371, "uuid": "ed948da2-f46e-42c9-b69d-f28903323f3f", "comment": "Malware payload (Mirai)", "value": "446a9262e534625937d21b95c9b0f20f22f0bee930ca3d07f3c752e5ddfd1ece", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079371, "uuid": "870c5312-dde9-4343-8761-7365b93e8b97", "comment": "Malware payload (Mirai)", "value": "090494a33eff6a0c5522db8290ed0df7df30d201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079371, "uuid": "4bb83d3e-9a34-4029-a716-4cf9c3e92c98", "comment": "Malware payload (Mirai)", "value": "90a921b3e40a8855f7c6aafcdd40e43b19161f62261a40150bcc6945c2a7ba24366ce71c0a2492aca342923f31a105f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079371, "uuid": "862213d7-2ca0-46c3-abfe-41d1eb1b84c1", "value": "T135C2D17092AE1CF5C7500532F7B857C9BE534F7DF6EE2890114047FA394290529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079371, "uuid": "35f8bba3-a2a1-4666-b63c-07abfd3970a2", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEDkOX0hymdGUop5hO:A8soTAZ3alkXLvFh8nNEws3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079371, "uuid": "d48e10da-51db-42c4-8c45-4edab64eb701", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079371, "uuid": "86cd8bca-b074-4954-a496-36270d5b30fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079371, "uuid": "887d796b-f3a8-4791-97a7-078dc836405d", "value": "ea8ee8a3a67c7cd2994788fde8231e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b00c0ad-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103235, "uuid": "80364c5a-d821-4c25-b18b-e51fb811f853", "comment": "Malware payload (AgentTesla)", "value": "a76135b0219f43671121085100872c0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103235, "uuid": "3ae156d9-836d-4c54-9310-30214281baaa", "comment": "Malware payload (AgentTesla)", "value": "44e7563cc23e81b456765229dd4343d8cf898e346eb0e6ee691b77b9a582d15a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103235, "uuid": "4b6fc6fe-1b50-436f-a8ef-6dafc15406fe", "comment": "Malware payload (AgentTesla)", "value": "4c9575c833cd46a99d52daca0d558d45df22f83c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103235, "uuid": "f3ad38d0-81be-41bc-8b9d-2ace979e959e", "comment": "Malware payload (AgentTesla)", "value": "e32df746b5cea9922f63ee54de2a2e2ef23835413d4bd8b99d23b7bf1f20d6df6d21c60395d396225693da503d5ac842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103235, "uuid": "908a105c-4ac6-4dee-9e31-1865a8ce5123", "value": "T175723A1DAE9DC527C6AE1B7814A2030A47B4DB3B7843E38F0EDCA5552917BD044D93E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103235, "uuid": "e859937d-01b7-47be-97dd-e7d43c786705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103235, "uuid": "0ba0b233-c114-4eff-9faa-9fc533f07c08", "value": "384:8xhxkRuxdvxLkSVe14rKm6LqbX0jkmafseVDx:An/vJkSrrfbietx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103235, "uuid": "1977be66-d60a-478e-a358-94a00686e104", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103235, "uuid": "0811a957-b771-453a-bf02-ff241b287b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103235, "uuid": "832c283a-0187-46c2-af13-d04d456de1c3", "value": "\u00f3rdenes pendientes________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bbc895-4d4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694071413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071413, "uuid": "8ea51241-f125-4b72-bbab-7c2e99432e4b", "comment": "Malware payload (RemcosRAT)", "value": "64c793026974573d251564a1dcf7364b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071413, "uuid": "b8a6f99b-b364-4614-adc9-4532bee83343", "comment": "Malware payload (RemcosRAT)", "value": "456f09b71ed09cbc590f6a3b8d5aacc7f0fb94521d8b19b80d2a201e5f73b5a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071413, "uuid": "d81e30ac-ab95-46e3-8ab1-07b500530aaa", "comment": "Malware payload (RemcosRAT)", "value": "67e021ec502f8a532c3216bb84c15386a54d942c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071413, "uuid": "e561c74b-f6e0-46b3-b9ff-03cfd4ba0878", "comment": "Malware payload (RemcosRAT)", "value": "fdae2f809f99c8491f21ba054ee6b4ded6c1e401cf66ea0e6c6a9837d0fa252a5407ec0edbe32d2a88c80f614cbd533a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071413, "uuid": "6b90a870-2b3d-4b47-bcd1-cd592a56c048", "value": "T1BAB4F022B691C072E45365341970C7A24A3BFCF28B65A5CF6BA43A3E5E70BD19B30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071413, "uuid": "71c6b477-ee77-4cf0-bb77-db7a66bcb7df", "value": "d5b70e22276decc41f732fe8162e7fe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071413, "uuid": "0e380a2a-8128-4fb8-a140-377f71bdb001", "value": "12288:w6jdZqR+3Xs9CBvOjCsCvIHH5jJ3CBw0r:w6jnqRYiCBvORHH5RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071413, "uuid": "ce9ed311-2f6c-450c-89d4-adfe5491bda8", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071413, "uuid": "7a3e9cb9-167f-40be-b946-31c3e225714e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071413, "uuid": "cd353378-8c55-423d-a455-8ef82e2ba7ae", "value": "64c793026974573d251564a1dcf7364b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2370be-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096019, "uuid": "cbe5499a-17d4-439a-88fe-423407d386bb", "comment": "Malware payload", "value": "21a314e1e39ea127b4cb31f364f525b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096019, "uuid": "2b69ad2d-d41e-4233-acc1-6b8b9b353b55", "comment": "Malware payload", "value": "46dfae32bb1e105fec9e4f4aac40648ea22b7aea848152862b0e15e9a9db3760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096019, "uuid": "017c02cc-b2dc-4f54-b58e-2d9198539c0c", "comment": "Malware payload", "value": "e1ebc1efbc5631f349ecf5c425108b0a447847b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096019, "uuid": "71dd47ae-6cbe-4ad9-aeea-fafda48f1d7b", "comment": "Malware payload", "value": "1707daaea75bf28d2abf7f3706058e06dfc58763f1ce75dd8aebe4e1d4e3ba9f5c47a2dd2c6b469c009a3c5a0195acad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096019, "uuid": "23353f78-cb31-4b30-9bf1-b4ea62a55a89", "value": "T13A156C335904CB67D02DC2B8BD230D6C2B25AF1D956AB4EB8C652D4B3EFA2574C8D05E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096019, "uuid": "c27190d0-5b32-4f5f-88e3-27d78c2b327c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096019, "uuid": "d813b521-d5b8-4302-ad62-67f102b54c5c", "value": "12288:W2p2F2D272W2s2s2s2s2s2s2s2s2FD+9UAptkyDq2O2g2d2z20Zq/UaZZZZZZZZ2:rDRaDqX+mxI7wPnK5cc/CHfsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096019, "uuid": "9bdfae2a-a0f9-440c-aa70-642559ef661e", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096019, "uuid": "85945eaa-4164-4cb5-9f68-84c18810b336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096019, "uuid": "3f2e7bf4-e7cf-48b7-8f31-0e2f2bf423be", "value": "decode_2cde6d4a73f350d051c11d9444560e55863307bda0e0e8249f26d9a513ec60da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e965c4d1-4d7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694092226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092226, "uuid": "f570e4b1-3056-4f8c-9b8a-2e5b48210e88", "comment": "Malware payload (njrat)", "value": "60c43dadda3fd0d3d992b9eb814c8568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092226, "uuid": "42b2f2f8-1dca-4366-b994-a08cb6caadb5", "comment": "Malware payload (njrat)", "value": "46e06dacf44ac7d30175b823dfd48a40ae6c8ad6c443fa4f7d20693e54bc3273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092226, "uuid": "caf2c6d6-a4f0-4557-b5da-af5f2fd77a56", "comment": "Malware payload (njrat)", "value": "0aa612225d512b969b599494c151df2bbf6c5790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092226, "uuid": "8657b0cb-aa67-4599-89dc-94fbdc6c8558", "comment": "Malware payload (njrat)", "value": "7f751fd8abbfd64ced0e3272647937e52e9c8d07a7e05d4a4a3c57e4a4327f3a409b8534f34e6a983c98bbe1a4a66791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092226, "uuid": "ee424427-b186-4268-a2ba-8c7158f0db50", "value": "T1FA13E78DB684E174D5FF8BF1B4A2B2890B71A017A902D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092226, "uuid": "0473cb70-1487-4694-87e7-96d85bfb8024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092226, "uuid": "6fde5908-2344-4ed5-9ff8-f62f9c5a46c5", "value": "384:K8Zyb7qyCEFmVoyb37MRaY2EdEzMghwzEIij+ZsNO3PlpJKkkjh/TzF7pWnC/grq:K6S7qyVAVlbLYHMQgQuXQ/on/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092226, "uuid": "c3dca295-4329-45da-a5b9-a95a57c21503", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092226, "uuid": "94261166-75a2-4c60-83f4-f7236203b1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092226, "uuid": "fa20024f-05e4-4b73-b0ec-d7721ac20051", "value": "46E06DACF44AC7D30175B823DFD48A40AE6C8AD6C443F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f70886-4dbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694118333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118333, "uuid": "a2e77a49-933d-4842-b023-e252010661c8", "comment": "Malware payload", "value": "94f77a4a0f3a0c77a1f18f20280919b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118333, "uuid": "2b190cd0-c48c-4a49-aecb-a3edae81e930", "comment": "Malware payload", "value": "477d1deae7b89760d0ccd71b81e74b6a34ca0bd0a3f88b92f95b232dbab5c703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118333, "uuid": "d1428786-a2d8-436e-acd8-54f6b64ac7cc", "comment": "Malware payload", "value": "a8292e1766bd3a004b136e0e0f82eb56e64c3762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118333, "uuid": "ea935a23-cd85-49c2-b2b0-8095c5f76c71", "comment": "Malware payload", "value": "a5b5ce7a5a16d6e28f80fe7e7f2708895d6719c66c04e357b626f197ce3638f2901cc956c8a1ba7abf45eae36521da70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118333, "uuid": "d6c71da6-3f2d-416f-9b34-3d9eed59b9fd", "value": "T116A4E65597548189E9A6C0BCCB5B9E07EF61F2085762E3CFC320D92B9F63BE06936314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118333, "uuid": "cf411878-0e00-4052-af40-4ec1188e9d8f", "value": "258d5aa0c07d3f1574af9885e1e5ed06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118333, "uuid": "211d4d92-d1b2-4dee-94fe-9073975628e8", "value": "6144:Ge9IFWHxvqedyZjFUp31j/MoKYhj0cw61jLB4k:Ge9IFWtups35/MoFPwQjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694118333, "uuid": "eb45ad66-4587-4eb9-ae7d-fbf78f97c60b", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694118333, "uuid": "e788c428-9bf3-4d4c-9e20-50dbc4a52311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118333, "uuid": "a77b6e42-ccc7-4fa8-979b-d2b6033e512e", "value": "php_redis.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6657ff95-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069243, "uuid": "65ecac55-266e-47b0-8132-aadf1868dd64", "comment": "Malware payload (AgentTesla)", "value": "c6a856b381728a69465a7f3d46bc3859", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069243, "uuid": "a74d7cc3-76fc-4cae-bb62-a60822c44be7", "comment": "Malware payload (AgentTesla)", "value": "4843f7c8ac3d9537258ed64787adf17a528caa58e5a4c3a457d79445cd9b5ea8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069243, "uuid": "de73e77a-144d-46ed-be4d-3188c6b2e0fc", "comment": "Malware payload (AgentTesla)", "value": "3f757a98f147fe16d9c8413c1272570445707b47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069243, "uuid": "48630e79-c632-485a-8d99-f1aca234b04c", "comment": "Malware payload (AgentTesla)", "value": "fe194d672da4b9f2485c7a8cefcab022685fb8ca5acd40235f887f416affc1418b5772ea787b9cd6d0e0afeffc76b9b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069243, "uuid": "77b63a31-89e2-4f79-ac65-0e12c4d193fe", "value": "T140F423E9084B6D735B4BF0B0169523BA08F79F84909EE4868ABC793E91D63D35818F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069243, "uuid": "05390ba1-7035-4b12-9ccd-01db5f126b00", "value": "12288:w3n7hbe3jKyHQbitS4IY9Cps+SWeFJY2DRIEmSnPlbAib7GKYWMKKnbKNlKG4T:w3n7hqzKyHQiLB9mOJY2DqEpntcVKsKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069243, "uuid": "32e69eb4-0458-469f-aa6c-285deef187ad", "value": 752928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069243, "uuid": "968c921a-3d25-450a-8e16-38e473697a9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069243, "uuid": "08eaca92-2881-4786-bc3d-e1986dc4b4ad", "value": "NEW PO 516805.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3621995c-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "233ccef0-92b0-4cbf-be0f-bfc923a9f3cc", "comment": "Malware payload (Mirai)", "value": "f33503ee730a09022bfeb25d9ac4b06a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "55534a48-b0be-4c45-85ca-0694f3defa65", "comment": "Malware payload (Mirai)", "value": "4878995e7b9f0b2f2231b61a7b7ca1bfaf253b5b61300a35c1e7daf4a89dad66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "08037cc7-1fb8-4608-a3fc-9726e1b6e86b", "comment": "Malware payload (Mirai)", "value": "71e1d5a169bfa32d251c710134398f640195b196", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "b25c445c-6a66-4255-b2a8-8adb16b74133", "comment": "Malware payload (Mirai)", "value": "b1b5a1c26a0e26909e9ac816ea30f3ca63068aa55ec3360fb03f3c673b51c81f533be20e73dc2f0fa94ec3a8f127c70d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "4bf6fec5-a40b-408a-be97-37859f42a1e3", "value": "T17733F1B692AAAD61C17052BB153A94ED64162338E3F5F00366314470E6CB2F34AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "a2e932e2-44cf-4b6d-91e7-b22a4f2ae08f", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8JnCL9VE8amFZP7R3u:Soqs2Twh6P8JnCLJ9ZP7R3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101804, "uuid": "9a2bb589-5f31-4b3e-a3b3-85f7fc65815b", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101804, "uuid": "b3c3a9ed-4e32-4073-8578-55f12fcb0fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "83710df1-1eea-4715-ae2f-44aa5a3adaad", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facf04f2-4d9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694104281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104281, "uuid": "11bc6e53-e90e-4e40-9226-7900bfededaf", "comment": "Malware payload (Stealc)", "value": "047c05627fbf98e350ff7af18b3e3801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104281, "uuid": "1b703e9a-064e-4058-b961-75e948787f80", "comment": "Malware payload (Stealc)", "value": "48ee7f000b4b170974bdff49f62062cd19d30c150ef6d5e51637fe9d8920546a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104281, "uuid": "8958ed8b-ac66-40cf-998d-572012286a47", "comment": "Malware payload (Stealc)", "value": "e3ba2794519eff9f23a8c990cda86a9417b12729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104281, "uuid": "0d492a9c-75d8-4d69-a233-316d31c6f869", "comment": "Malware payload (Stealc)", "value": "cd5343cbbd831941c16c86cad409e832199a39a18407815a733b373f4e4274f75e75cc68b810eff1ce8ba8b2f3becb07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104281, "uuid": "9a5da7d8-925a-48f0-b540-fdc4ed9ca781", "value": "T17A645C13A2A16C61E51747318E2AC2E46A1EF9E14FD537EB3354AAEF2DB43E1C572310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104281, "uuid": "1f613a61-e3a2-413e-9b2a-edf4924277ea", "value": "e77054925f91bbb709fc17135ae0c093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104281, "uuid": "822e1256-a058-41f6-93aa-3ab039db4989", "value": "6144:PhA5DUSazDoybXA5mkJIw4jawEZ62VCet:PognnoyE5PJh6awEZ62D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104281, "uuid": "28e11dc1-7a14-4683-8094-c789765e60c0", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104281, "uuid": "75ef49a2-e056-46ae-a6bf-656b88e60ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104281, "uuid": "97709678-8ad4-4de1-b20a-b0866da62225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66ad515-4d8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694098207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098207, "uuid": "2337f7ab-0b7f-4d14-8ed3-e96bee178332", "comment": "Malware payload (Mirai)", "value": "131401cde3fe6183efe0b2701faff051", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098207, "uuid": "ac22e651-60fb-4bf2-8ea5-2925f964fb3a", "comment": "Malware payload (Mirai)", "value": "48fadf42f35e8ea743f685662c4b42a4234930ba4338821f783d5e061be7ab19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098207, "uuid": "59740648-5a41-456b-9f1f-cb255e3fa4e3", "comment": "Malware payload (Mirai)", "value": "d30b600f51de6db2249d17819f20d32de13f7e00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098207, "uuid": "c4e18d20-9c44-4f9f-8382-5ae85030c8be", "comment": "Malware payload (Mirai)", "value": "4a2966bc922137a2483bdb7e1b67afbf9489accb3bc1d984287c2dfd14d61dd2782022ffc88179485d7756c880e8ad2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098207, "uuid": "b33b3e72-8e50-4132-a0c7-ef1a73dc6c14", "value": "T14DA2E11462632E65F3ED1C3CC96A8357F9A71BFC90F5327679406620C94D24A3E38B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098207, "uuid": "5eb35cc7-4084-49f2-802b-8c0f165142e7", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjxS3xhymdGUop5hQD:vvQn4j+ZO5fKAlxVShs3UozeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694098207, "uuid": "9004f954-c221-4477-8d2c-bc9f4841c477", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694098207, "uuid": "a640beaa-563e-4081-8c77-eb9089932d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098207, "uuid": "6aa8ed30-f9f7-4a95-9671-97598f839738", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a9c66f-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694085697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085697, "uuid": "af2249fb-e071-41da-99da-b0a20415fa24", "comment": "Malware payload (Amadey)", "value": "527ec5b18d10ecf7d108a9482e92730a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085697, "uuid": "90a396d7-37e0-4887-aae7-8e22828622cf", "comment": "Malware payload (Amadey)", "value": "493795077cc95257ed9bfb2348c6fd811d3c3c324326e0489315171718a058d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085697, "uuid": "c7c8b16e-3bd5-4c8f-acb0-4069bd7718e8", "comment": "Malware payload (Amadey)", "value": "c74d648801275de441542061ed443e02abc7c44a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085697, "uuid": "36ff8182-892b-4811-b47c-782eefa20c7e", "comment": "Malware payload (Amadey)", "value": "5b253ca6bca6b26c5f4df58abd3e1b9c5c64de0ee662a574613057ff34cf93004d8acec0e33c4cb96fdeca87ea179ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085697, "uuid": "191cc455-37c4-4732-a1c9-0aa2b5875373", "value": "T19024F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085697, "uuid": "ea9ce1db-c61e-4a8f-a436-fdcfe35bb03d", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085697, "uuid": "c30ab40c-f8b4-42c8-afc6-964b56736953", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085697, "uuid": "93814a4a-aa87-4b0a-b4f0-25e4b9610530", "value": 226111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085697, "uuid": "c6b838f3-8206-4908-98b5-b5a84fe8ca50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085697, "uuid": "d35539d1-8ce3-4e4e-8df5-35d1807d0a49", "value": "527ec5b18d10ecf7d108a9482e92730a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4d5f35-4d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694094731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094731, "uuid": "f158066a-4574-425a-84eb-fe0a120f9a35", "comment": "Malware payload", "value": "2e23843ac0ea9fd8fce756d6aff95798", "object_relation": "md5", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094731, "uuid": "f8c62c4a-bb83-4142-8c17-617a29dc13cb", "comment": "Malware payload", "value": "49730007d83d3f5427b55fdf51194aa9f9466ce31b443e7de87679861d70bef6", "object_relation": "sha256", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094731, "uuid": "b73667ae-fcbd-4ce8-ad8b-054dea495fbf", "comment": "Malware payload", "value": "809eeebc83c54c71f92ee5b2beba43f25d933e2e", "object_relation": "sha1", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094731, "uuid": "ce00e8ac-34e4-4205-9dd0-7bf473287780", "comment": "Malware payload", "value": "1e5d39519c59445ab30c3b192160c35c39e468c5d504e12b0b2c47df743f37bad3db87f15824e05b13caa8ea2656dcba", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094731, "uuid": "6d0d2f6b-4a74-4cee-87ae-dcea6d4c9f90", "value": "T18E01C916264FBCAE185BF2D6BA7402812FD35040BA583631A7056C2F9E36C3882DF898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094731, "uuid": "444c352e-ff93-41f2-9127-37cb73de7e61", "value": "24:TI2hzEPI8tlBapUz3lnx78G1fXXfDzsPuD:TI2tuIG13lnx78G1fHfCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094731, "uuid": "3307a07d-c0e6-408e-b492-8018c1b46b18", "value": 825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094731, "uuid": "c6af394d-b858-492b-9778-0354285b1f42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094731, "uuid": "a9d61ed7-94ca-4cdf-a75b-acd8122cbaca", "value": "Client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4500789e-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075630, "uuid": "10bcbdab-c2e7-4083-bc6a-a387b41ee964", "comment": "Malware payload (ConnectWise)", "value": "81bbd0a22ef59229fdf80c0086019263", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075630, "uuid": "35e681ea-4187-4739-9cbe-3425c5e285bb", "comment": "Malware payload (ConnectWise)", "value": "498e9cf7df199819595af31c252509ce91c3ee251c09ae7072287286f51606b1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075630, "uuid": "55c148c0-91b7-47c0-b770-388028aae5d3", "comment": "Malware payload (ConnectWise)", "value": "cb9ad89bd094c0f077f12a884197c260ae8e41de", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075630, "uuid": "47e2e05e-bfa5-4af9-8266-ce3b2fe04f07", "comment": "Malware payload (ConnectWise)", "value": "fa8d83b2e5fa3c46cbac9867621d2be8dc7c6c51dce122957842ee685ad58b9c37741052168ce294c2a464bfd8a16ef7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075630, "uuid": "3c8fc5f9-76ab-4d89-9d2f-59ab9940ae9f", "value": "T11A836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075630, "uuid": "f6ed26ff-939e-4686-a23a-f9059f3062b6", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075630, "uuid": "f2218014-e284-4184-9c3b-cb10533aa434", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Jk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075630, "uuid": "bb352aa0-7684-4b74-9e26-69b5273f763c", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075630, "uuid": "320442e2-84c9-4f45-b79c-8bedd594af39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075630, "uuid": "092bbe80-9e32-41e5-85c7-1903c7020d56", "value": "81bbd0a22ef59229fdf80c0086019263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d082d50c-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694086601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086601, "uuid": "be5c2983-59b0-4a41-b920-6f869e821b01", "comment": "Malware payload (RedLineStealer)", "value": "d4962919af2fc15eb39dfb621e145d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086601, "uuid": "b81b9e9f-b9a3-4778-9fca-fb9f0f1c907a", "comment": "Malware payload (RedLineStealer)", "value": "49d0f1575d27ab9a9d5b9c92f569afc6922d91bcdc3a8b61817b1c05800f98b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086601, "uuid": "9aa14c83-6adf-4732-bf5c-677d036730d6", "comment": "Malware payload (RedLineStealer)", "value": "0310a25b9269d2fce843a4294a9c0f1abde2799f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086601, "uuid": "bbe0c004-ba83-49b2-b598-3dc320b21ce4", "comment": "Malware payload (RedLineStealer)", "value": "6268a26a41b58d3d95fe4b8ff35dddefddcd1acbff07662865df72519b7e9f4e52db7c0e1732812ec93daf5cf63d897f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086601, "uuid": "8af9b578-51af-496c-be92-25a63e8d7cce", "value": "T18B05231369E85076EDB517B01CFA0BC30A38BDE59D38DBAB2754A44F18B3394A43176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086601, "uuid": "53d70edc-2651-4b5d-bc00-3507a057512f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086601, "uuid": "b021cad3-7fdf-4ce9-a5ff-a9cfc7a37c1b", "value": "12288:lMrZy90uhUdGsTfBEyGgA0uoomngU4lAx7zYnNOdwZNaTq9mAMzQckqGuQineg0E:cyfs7BamZYVnNEweH8cMDineXf3RyXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086601, "uuid": "862f9510-34ad-41ff-8c13-286e5dc7d163", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086601, "uuid": "9e8b91ce-c55f-4be2-bc3c-7cf2e6708058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086601, "uuid": "bbc65dad-ed86-4415-94a3-9bfc09aeee99", "value": "d4962919af2fc15eb39dfb621e145d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e12e898-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694103213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103213, "uuid": "6a9c6186-4a5c-4496-87e9-99ea573de17d", "comment": "Malware payload (RemcosRAT)", "value": "f80d07045b8aba5de2ba621910e001ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103213, "uuid": "869ec70f-0f3f-4012-92e9-cd25ed338e2e", "comment": "Malware payload (RemcosRAT)", "value": "4a30f84c5fc555603a11244bf58e1a01bacfc09047068f942d48d674a1375c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103213, "uuid": "e6cbdd8a-609a-44d4-9f57-95fa21dd7127", "comment": "Malware payload (RemcosRAT)", "value": "91d543054f3fb15f5ca7ce2ff0b447b548d7a90b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103213, "uuid": "74b98983-66e8-4616-bdcf-2027442fdc46", "comment": "Malware payload (RemcosRAT)", "value": "76ca8ac5d4bfd2ab5945c158fba7da72f4075d50825cd0b364f8eecf3d178a1e901a309446d8a235de28afcaaea4e16b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103213, "uuid": "2875f920-0a43-4c0b-b3ce-b664f28c1683", "value": "T1CD84E1117714DC07E313527485E0EBB88B68BFE41D968A56A7FA3DAB3418B93FC18391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103213, "uuid": "53607540-8e5f-4d45-af55-00cac88232a1", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103213, "uuid": "7faae4b1-7a96-4887-ba13-bc141b34b3ef", "value": "6144:IqaFH+9KGmy45F3aK5/FnSHKqcnHfuPodNgDzBQxCrjNqms5IbPhalnKay:I5Lvh59j/FnLqSHfnNMdrjNm5IUlnKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103213, "uuid": "bb4d1636-15e1-411e-acd5-839e89a74590", "value": 396720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103213, "uuid": "cc4bb42b-88e2-483e-8572-1af1159d1da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103213, "uuid": "96fbee6c-b880-47b5-a47a-8bbb6d9cb87e", "value": "ERK M\u00dcH.-12730-0509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b630fc3-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079398, "uuid": "638e8256-2984-44fc-8e4c-cc107cc290cc", "comment": "Malware payload (Mirai)", "value": "e63b0f5fcdaa39fd9816cb96bf4da9fb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079398, "uuid": "0e0d74d1-1e12-4bf9-b578-8a6cfddfcf06", "comment": "Malware payload (Mirai)", "value": "4ac8d64d8ff6176f1e71622aeb1533f87d35bf2710007c3313605a4f2bf0d80b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079398, "uuid": "7d22088c-4bc8-4051-81e4-86edf8a4a743", "comment": "Malware payload (Mirai)", "value": "fe37a38c593d42924c03e57ff3cae5cfac15f06d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079398, "uuid": "1eb109bf-c89e-4a39-ac87-931680e58e5b", "comment": "Malware payload (Mirai)", "value": "b6d21d5a0e68276fc6bd7364bfc243d833534564f1236a08d38a539f72bae5072a17df0addf9155785f02550b0cde943", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079398, "uuid": "b3b7d371-2524-4953-a66d-912a921a9a98", "value": "T123D2D0EB64BFF277C0766874207401D4FA3C3912E32D475F0CE9AEAC5AB26813B64A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079398, "uuid": "f1c56ba1-01c5-4eb1-a0dd-eee539ce1f01", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPO/pSx0sd:UYJdJZ5UQVH/+KO/Utd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079398, "uuid": "bb67ae8c-4636-42d6-9266-772bb5b23051", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079398, "uuid": "bf83cde9-f4b5-4fe9-93ab-c2bc4e1466fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079398, "uuid": "be67fa8d-9c97-4269-bcb5-d5d8e127315e", "value": "e63b0f5fcdaa39fd9816cb96bf4da9fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76210058-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069269, "uuid": "c2dacf6d-c0c2-4c69-be86-032820d5a6da", "comment": "Malware payload (AgentTesla)", "value": "58933352559256473f67bff752931893", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069269, "uuid": "6d76a669-cf78-45a6-b511-71b0579ed388", "comment": "Malware payload (AgentTesla)", "value": "4ad044b7c48570f292ba1439c50d031dc93fef51e247076e7267d0f17c6dd975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069269, "uuid": "d1b0ffea-01db-4a64-b40e-c9a0bb65b248", "comment": "Malware payload (AgentTesla)", "value": "7b8c269c8f07ebec76bf16eca4cf6678f3a66de3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069269, "uuid": "fbe27a7e-d303-4496-8ac2-d53817b324bd", "comment": "Malware payload (AgentTesla)", "value": "37d07ee46c5e7b9d5c69c554e615b41208f419ec566b8ad775be91d4dd04d058ab39496a482d7fa925625039e356908a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069269, "uuid": "941ee625-b9fc-4786-8e7a-cb68d3250f91", "value": "T1E2D42378CA64DD74C8CB51F8D249ACB4D66C9A78410A26F36257E338F13C1C9768AB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069269, "uuid": "8501ab83-3d3f-4b4a-a9e1-cffc6ba4687c", "value": "12288:kCWhx0gtTtbOupP/FfS1199hWVZ0hup2fw44MkZZwGprufvDimzW:zWh7wupVfS11A4owfvijeDimzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069269, "uuid": "200d08f6-f0a8-4e9d-980c-725624649b56", "value": 601865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069269, "uuid": "04d7d52a-2f67-4cd5-bc16-60cf890d70a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069269, "uuid": "e24bb1c6-3964-4448-a9d5-7a04a268ec80", "value": "Outstanding Payment 0692023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9aed8b9-4dcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694126613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126613, "uuid": "1f0a4635-d361-4480-a0ca-2584d29a5d22", "comment": "Malware payload (MarsStealer)", "value": "3d7c5c23b3420e3c6382fdc67a273fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126613, "uuid": "9dd96e24-1fc5-445d-b7df-4257e72dfe99", "comment": "Malware payload (MarsStealer)", "value": "4b4433f996643f1b9716e29e3f89b542d935ed4fbd7b18269e430d171e9e8200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126613, "uuid": "3af8be91-9ba0-43e0-ae7e-7d755c38c5aa", "comment": "Malware payload (MarsStealer)", "value": "35e850a563005659c3f19f5d367372d7a7e96c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126613, "uuid": "69189794-43a5-47b0-b6d0-63256adcf0a7", "comment": "Malware payload (MarsStealer)", "value": "24b0c6643fe9bf58d64d02d9c25aca943419e64b4fa35f768c3dcf9137ba0872475880051d2a39976c9df6cca92faf3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126613, "uuid": "45248904-e227-4670-ab85-9218e8176758", "value": "T163646C1362E17961E1274A718E2AC2E42A9EF8E14F5577EB334CAAEF1F701E1C572311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126613, "uuid": "04e89ea8-dc37-4beb-82f5-f9d311144a51", "value": "badfd3002a7785754765042ffe6b2bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126613, "uuid": "ee019671-e524-4348-b365-6c3ba761ee30", "value": "6144:SoO+nalpeX9Ts6dda1vkw6F84d1pTAMuqCqfMy:hSC9owdCmq4RAMzCKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694126613, "uuid": "158d006c-257e-4814-82b6-b17374d29d83", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694126613, "uuid": "1a921217-53fc-40a2-9047-9ef14fff4774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126613, "uuid": "dae1ae56-a950-42f6-8237-55bf6fdad40c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd40945e-4d21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694051779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051779, "uuid": "2a2102a2-f127-4d71-a5b7-619a6aac0075", "comment": "Malware payload (Amadey)", "value": "15d5a865274ba6c4847056b62ab3e205", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051779, "uuid": "dfe38b40-32b0-4e29-9b64-8f7d7b9cc559", "comment": "Malware payload (Amadey)", "value": "4b5fa079124d4fe2780f905ea804986908e88da60c74cec561124195a4843bdc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051779, "uuid": "df0954c2-dbe9-4f1a-84a1-0afe274a74de", "comment": "Malware payload (Amadey)", "value": "26f4b78f941a5e645f55ef0f1ae66635c7870abd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051779, "uuid": "f1963eb1-18f1-4b8c-866a-c29a7de1eeb4", "comment": "Malware payload (Amadey)", "value": "81c711a7bc2a5b19b776661b4ca332f7b6d35e54dfb82a4b42f2f2d2d540de04d7285467651d116ec4b2ec3017b12b29", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051779, "uuid": "615b2dc2-6d7f-4ac4-b0d0-58b99de0549f", "value": "T14824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051779, "uuid": "ce1972c7-df54-4616-bf98-c88cf8e3bf1b", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051779, "uuid": "7942a0ce-91e8-483a-95fc-17178e09d6a3", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694051779, "uuid": "f3bb8fb9-d99a-477f-9703-1310ebf953c3", "value": 225631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694051779, "uuid": "127a83fb-59a2-44fa-8d42-235fa4e0586f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051779, "uuid": "a07b6e6e-bb5d-4c69-aa5f-beb4570727a2", "value": "15d5a865274ba6c4847056b62ab3e205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f6c393-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Worm.Duptwux)", "timestamp": 1694085156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085156, "uuid": "88637d44-e3b7-4469-9359-75cf4c1b4f94", "comment": "Malware payload (Worm.Duptwux)", "value": "e955b1874dce2351a24a8e5aba89adf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Duptwux", "colour": "#E62496", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085156, "uuid": "ecf16ed5-d0c7-4950-9569-ca347e9bb998", "comment": "Malware payload (Worm.Duptwux)", "value": "4ba68170e72aa32fc91b838de9d78ffc1d251aaee4c3dcbe6a1a99818654e296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Duptwux", "colour": "#E62496", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085156, "uuid": "acdc3183-691f-4614-b8f0-9fb09c97deca", "comment": "Malware payload (Worm.Duptwux)", "value": "353e972669cc4149b9c68d49c891c73ab3d68acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Duptwux", "colour": "#E62496", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085156, "uuid": "e228a27c-6ab5-48e4-9346-609f8cae40af", "comment": "Malware payload (Worm.Duptwux)", "value": "e0dba77051fde4639f7828e21ac6bbe076007e709fe411f61b5ed60b844ea4d2af9cfb1410bcf4046988a1a2c183e2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Duptwux", "colour": "#E62496", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085156, "uuid": "dc2525b3-eca5-469e-8cc7-cd4b9329d99c", "value": "T13343BF1AE75607A0D9A418FCAA7F0C0327BE7E706C8C7F6109513A2A1EF75735E48672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085156, "uuid": "711f2370-4d59-4825-9501-9c724f31d8a2", "value": "d4ea3020f7534cd85f493e2a728e787e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085156, "uuid": "616b731f-72b1-4e89-80fc-e023e3be80fc", "value": "1536:JdXkE87nccOtwqsIcGIjAPdrl8sQpCXofW:rUE87cxtplAKrisWCXofW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085156, "uuid": "2944ef66-9679-49a9-a184-40dcfc3ff232", "value": 58686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085156, "uuid": "a7883166-b455-4329-bf00-f0f65784730a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085156, "uuid": "0d999068-a8f8-4dce-bd18-998896223bc7", "value": "Trojan.Autorun.ATA_virussign.com_e955b1874dce2351a24a8e5aba89adf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0759de6-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075783, "uuid": "4dadd7cd-ea71-48ff-aef8-374acea56120", "comment": "Malware payload (ConnectWise)", "value": "ec07c80da832279de2d6494b413c706a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075783, "uuid": "c05dd79c-3fdd-4c38-803a-f0084c4af336", "comment": "Malware payload (ConnectWise)", "value": "4bafaf06040db7511f632379628c2af93a57f01bd6fe6a660e1737563fbc5566", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075783, "uuid": "b38243f0-f924-4076-9962-ce4c31532215", "comment": "Malware payload (ConnectWise)", "value": "d635b90d1c289df6d79523bc4a9d483dd45fd991", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075783, "uuid": "185701af-58f5-4a1a-955c-4823f2989ab6", "comment": "Malware payload (ConnectWise)", "value": "b023da32879f8d4a364da6e50cd70321ef1539b2bbbef0dfea96f5e5177a529e74dc444677ded1689d9b6b20c0b2c7d0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075783, "uuid": "40e36e69-8e64-4a2f-b477-5720cb87c218", "value": "T1E8835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075783, "uuid": "a3c4af72-ca45-4ae7-98a2-0c7bae8ed784", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075783, "uuid": "f721765e-6e35-422c-8164-3f89a2ed693c", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3tk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075783, "uuid": "37390084-fab3-4e49-ae66-7073dd0715dd", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075783, "uuid": "15199ef6-fc75-4696-891d-04cf5a57dfed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075783, "uuid": "ce943732-4cc5-4eb9-8dcd-ba2514d54b7d", "value": "ec07c80da832279de2d6494b413c706a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8aa2457-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084924, "uuid": "7712e15d-b80e-43d8-9123-6b3ab09dac3e", "comment": "Malware payload", "value": "03311f48686395e1e9da241413616fd2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084924, "uuid": "e9005e12-e143-4c38-ba8c-6a1c0e27cd7f", "comment": "Malware payload", "value": "4bd7b3fa7e974323e1ccc8da9196bf7b7dc1cf62590f19decbbe246c931d7634", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084924, "uuid": "50209641-b16f-47c2-8e89-66d47fe56b69", "comment": "Malware payload", "value": "bbba03c86107c5b191d00e8a5b884f3cd3dd7728", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084924, "uuid": "63536abf-95a6-4968-929d-3bd8d19bb965", "comment": "Malware payload", "value": "50c957f523b2ebf00d382599f02a54592224c1fb51d1b6b6a5fa2410ebf05ac0bf80a74f74d437b7952e3372c110dc12", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084924, "uuid": "9db4cbbb-3535-40a0-9695-52522f4e554c", "value": "T1D0F30CF7EA43D40BEA9CCA312C9D7FE192D56A25679D07CE5908A21E0EBD140CF73861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084924, "uuid": "59230463-01a4-4f8e-a4de-1ef2ef13bcdb", "value": "3072:flxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA0y/j9Mo8yTcfc:9xEtjPOtioVjDGUU1qfDlavx+W2QnAhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084924, "uuid": "17c50326-5585-4203-aa49-69fd2c22ca77", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084924, "uuid": "604a68cc-c3ef-4577-83de-90bd707485d6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084924, "uuid": "f42515ac-3948-4504-80c4-6da6c240f017", "value": "03311f48686395e1e9da241413616fd2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918f1f32-4d91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694099810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099810, "uuid": "71b41ef8-aaf6-45e9-aa26-3bbee84c8ae2", "comment": "Malware payload", "value": "22b2b36ef8daf58d43d0f6593957cf5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099810, "uuid": "9678c8b4-e2c9-4cd2-9ec1-3f8434cbb510", "comment": "Malware payload", "value": "4c70406dafefa981ab09927a59f4dcd161e26cca3265645f0704199abd4e2b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099810, "uuid": "20d341f5-8d12-47e9-8c13-32dbef318d49", "comment": "Malware payload", "value": "a612a6e3a532166609e35c85116d941118995b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099810, "uuid": "e2761737-5ff3-4194-a8d8-e7acdfde7811", "comment": "Malware payload", "value": "a217e3e72dc50588c5586c80d1ea18cbec27c925187b6088c08089ea99bb3a6982fdd7c41867d3bc44501a3923af2b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099810, "uuid": "7ff49a80-1363-43e2-8337-42b394e063f9", "value": "T11876221F2E446084D4F0D93A5567AE9CE0F3626D8DC1ECF861A579C3AEAF39C5211B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099810, "uuid": "f0838f21-3051-497d-8586-af0e439c67e3", "value": "6f460aa1477a9dc0ad8950fc7506f88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099810, "uuid": "6a3b71a9-1187-433c-a763-54c7f5300d3a", "value": "98304:rsTiKVZNca+y+hhoLE4iRHoN7BLSaOyJ3oUoe2Fs62kYYCHGUlTR79mbuOnVyqI:rmn+an+hhP4soPSaX2V25mUb9quOnAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694099810, "uuid": "24b4ce71-7a5e-46d3-a68c-e7e4c38e9e08", "value": 7528936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694099810, "uuid": "a0b5024e-a4f5-401b-872e-ced53e853f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099810, "uuid": "1d8c9646-608c-484e-8eb6-140f3747d870", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422db3bc-4d6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694083356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083356, "uuid": "d9a03af3-0334-4902-b9f6-d3c20c69c573", "comment": "Malware payload (njrat)", "value": "bad0705d073f30727d984aaed31e6145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083356, "uuid": "f8b5fbd1-6356-4fbb-8304-257a9a62e2c0", "comment": "Malware payload (njrat)", "value": "4cc8cc5bd23be4b56ae87f5c53dbe2844899ad627a56b2f5f0ed8618cb4ffe5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083356, "uuid": "e3824c99-1297-4e67-9c8f-9a06e099ac1c", "comment": "Malware payload (njrat)", "value": "da43696d7bb7fd0100e3556b6f0714a56a909e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083356, "uuid": "39b31e46-da8c-48d7-9151-a59e6a372cfa", "comment": "Malware payload (njrat)", "value": "e9d3a45e0f2963b42118402ba11ab92d017b2191d441794e4786d1b96ec92224a31835869525f9ba30e0ab108fc72763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083356, "uuid": "0882a553-c50e-4635-8f2d-b4fc99d10689", "value": "T1A813F74DB794E174D5FF8BF0B492B2890B71905BA902D30F99F154D94BB3AC09A10EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083356, "uuid": "fd90cf17-e010-46da-9200-0a10ce97b540", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083356, "uuid": "c80f14a1-4c55-4059-9cb5-7350996ee1b0", "value": "384:WZy5raLd2fo7yx2tsMtNtlMXc9a1Qu9D9O5UE5QzwBlpJNakkjh/TzF7pWnqjgrG:Mpogmx0d9ocg6vQO+XR+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083356, "uuid": "c141e2e4-5dd2-4e97-98f7-b0ef9172b34b", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083356, "uuid": "9be3c547-fffc-41c5-8aae-e9d475927dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083356, "uuid": "2a576732-a867-4066-87ff-4058bb6e5474", "value": "bad0705d073f30727d984aaed31e6145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6f2efa-4d41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694065285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065285, "uuid": "d740e376-f36b-41c1-a091-bfa01edadcac", "comment": "Malware payload (Amadey)", "value": "a537df6b1dd847e516f3e758b9a08a31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065285, "uuid": "828e5e20-c2f6-4d45-8fed-999b3b14bcb0", "comment": "Malware payload (Amadey)", "value": "4d7b095ec2fad97ddab71fb2f126a6c675a544432a491bece8226161b2b3367a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065285, "uuid": "290597fa-47c1-4218-9555-6e72544f868f", "comment": "Malware payload (Amadey)", "value": "aeed2197db4fc8d3decde16effe2a6a59ffc6142", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065285, "uuid": "0033ff1c-3f99-40fe-9691-20dbc72c571b", "comment": "Malware payload (Amadey)", "value": "d7f6b8d14037221d858e274a8b507d81385e4037a10c5f7e88fa2785e5adac39e77d27de4f4f4cd09b033662e7cb17bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065285, "uuid": "7aab5458-66df-41c6-b2df-a73793968e0b", "value": "T14824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065285, "uuid": "7ce299b9-e077-48d8-939c-c1bd0b5952f7", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065285, "uuid": "0a7baffb-9dc5-4e78-b511-047ffd6b1959", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694065285, "uuid": "1d245225-633e-46b3-98a2-96f481afba8d", "value": 225808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694065285, "uuid": "06f9a046-ac1b-434b-a483-93bbd7a055eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065285, "uuid": "f7c6b606-626f-4cfb-a346-f78946a549e5", "value": "a537df6b1dd847e516f3e758b9a08a31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682f4808-4d42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694065810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065810, "uuid": "9f34e443-1685-476c-882d-15ea6ee06972", "comment": "Malware payload (Mirai)", "value": "2d39ea0be150cb72614a450497bdc68d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065810, "uuid": "fcb9ed6a-92ec-497d-97ed-e5b58094a9ba", "comment": "Malware payload (Mirai)", "value": "4d8bf031ffaccbb17fe1564a896bda049fdcac469fde893f5f6d8ff87777a228", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065810, "uuid": "ae80c322-e380-42da-a494-f146f168978b", "comment": "Malware payload (Mirai)", "value": "7c032ecf767bb5a2477f92e45a3716fb1b08686c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065810, "uuid": "f1afc724-2d83-464e-9e36-cf91dcc77f21", "comment": "Malware payload (Mirai)", "value": "9493bb6dcf59c0720ce360f96ad20dc1b1c10d7cff4479006a802bcac6913b4c4074c248d2e028a98e49b973448597fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065810, "uuid": "6f79e227-0164-4fe8-81c4-0eac1d9dd864", "value": "T114431854BC929A26C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065810, "uuid": "184f2d2a-a6d8-409d-b6bc-f2b11239b087", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5sG1:wXYWyCc90TIQp2xyR6G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694065810, "uuid": "6cde5a5f-20f2-4208-9dc6-b6c39e23cd9c", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694065810, "uuid": "e9e6d3ce-3f77-43bf-9e58-bca4278fccfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065810, "uuid": "79a609ab-c615-488f-aba4-8ccc03f84869", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97341694-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694107980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107980, "uuid": "c520c48e-dd0d-48f2-b274-c21dd99a548b", "comment": "Malware payload (AgentTesla)", "value": "f645c39596545a4c9ff1fae2c1df4719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107980, "uuid": "ef6c7806-d6e0-4b61-9920-d126257f1487", "comment": "Malware payload (AgentTesla)", "value": "4e4d31c038b40c4267f2757def2a94a87d47f934b265cfe2b298274751a1ea48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107980, "uuid": "67d7d60b-2f30-4bc9-b225-9fac8c4f8253", "comment": "Malware payload (AgentTesla)", "value": "dbc148ff48b1d524ab5d65d87701c53e25a448b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107980, "uuid": "2ce7152f-73bf-4349-9577-a096f7afbea6", "comment": "Malware payload (AgentTesla)", "value": "538031966b022bf1f7bfc866e8dd9e07ce8de226994852cf52a9c6b9f336a20136e42dfde4d1530914134dd4c2f08526", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107980, "uuid": "5eac95a0-428f-47e0-96b5-ab6b8ceda0bc", "value": "T160F44A47BA4789BAE67417B6C29A180413F4DE8633AFDB0BF5CA33A50863376DC05527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107980, "uuid": "69a8aec2-309b-4c42-82ae-dcab40f3a0f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107980, "uuid": "c052af6b-76c6-4fa1-9816-bb21712a6130", "value": "12288:jYj4k4yJu5zM85pm/Fb55Jnz4YlBEMO+kfrg+dWC9OTxtq:xhyJu5zL5pGxnz4eWrE+gC42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694107980, "uuid": "43009032-558d-476f-895c-de6360d01b99", "value": 779256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694107980, "uuid": "65e3639f-a1e1-4578-9488-2e512bb2577e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107980, "uuid": "2b7c75a6-db31-49ef-aefb-43b0a2d9332c", "value": "SecuriteInfo.com.Win32.PWSX-gen.19939.26903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7454db2f-4d22-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052087, "uuid": "dcae266a-64f2-4c83-b3c2-6390114f3307", "comment": "Malware payload (Amadey)", "value": "56bd5d39a8e39df19dac3f7a490398ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052087, "uuid": "c472312a-a755-4903-aae0-749324b3c1cb", "comment": "Malware payload (Amadey)", "value": "4e5e27d6601b106aefdf8fc9a1ad3cbc38cccd4d508ec68316b90b6b60455ca0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052087, "uuid": "931a6d83-6a80-41a7-b37b-10695eb54bcf", "comment": "Malware payload (Amadey)", "value": "9b33f689bcfd89f382452a9b34a3dc24e4b9bffd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052087, "uuid": "9a1ecc35-f2bc-49e4-85d1-91a8808a26c3", "comment": "Malware payload (Amadey)", "value": "151a0c78275f14599a14a12501c508ef91f6eb2798b87c27c3465c9742546245c9a857193ba5e47f4edbc88d54524ecb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052087, "uuid": "ca2c9082-627e-4eb5-b7cf-4f06d6d1a516", "value": "T12924F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052087, "uuid": "9abd22b2-1c11-4f88-8435-255efe32709e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052087, "uuid": "e1a5429c-ed73-4e07-ad55-2dae4ba8300a", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052087, "uuid": "6846f0d9-fe95-483e-9b9d-111a7efa5e23", "value": 225498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052087, "uuid": "038c9a54-7d96-4389-b3ff-fd8417faf1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052087, "uuid": "59590152-e08f-43fa-a4a8-8e4ee98f04b9", "value": "56bd5d39a8e39df19dac3f7a490398ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9154713-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694079690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "f840c776-3228-4d32-85a8-69f97ad0e073", "comment": "Malware payload (RedLineStealer)", "value": "d35a222cbc5cbffc2af4a82e7a70f68f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "f4fe1383-7470-47c3-a1a1-667d9ca2c1f4", "comment": "Malware payload (RedLineStealer)", "value": "4e97da35ff462154c09b4dcec2fd7bc97f639b356ec3ea65873ac37e0a781193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "1cd76917-ada8-4ac6-8aa3-a363ef7815d0", "comment": "Malware payload (RedLineStealer)", "value": "bde3434f7c5827d6c7e11767489b2b68d6c192ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "98cfcce2-c3fa-40d1-a0d2-b87b19b45ea0", "comment": "Malware payload (RedLineStealer)", "value": "ccfb7d391444198015a9f9a703899a2445943f3c1ad9b0e53826de02d4b517d9a397ba590abd63bc841e490046598f50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "1985c205-b891-4244-84ed-9a5f4419b154", "value": "T1A9052356E6D84533ECBA2B701DF603E309397CA20D74875B7387585A2D73AE0A931367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "7a168e93-cb1b-4ea0-90a7-50c1c41d3acf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "e9bf737a-2131-4003-af26-ae3fe42af373", "value": "12288:5Mrfy90/O7gtjd6GL4Xz8lIGgWvtap0Ix6PyOjQ+LPcybnuQFHiQojEFw8qWvkWq:Cy04qjd2Eblap0IY6wPc8nuel889zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079690, "uuid": "9e3248bb-857d-40b8-9cdc-6199e52173ae", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079690, "uuid": "7851b0bd-e96a-4e4e-9f66-6c47e67d995e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "fcd95a42-707a-4b15-b08f-89da4c21871b", "value": "d35a222cbc5cbffc2af4a82e7a70f68f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f412fe07-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075494, "uuid": "1aa6ca28-6370-49d3-a697-fbb40a8ec6b0", "comment": "Malware payload (ConnectWise)", "value": "2c32fc2bcdf7d18eb83f2cd65b8eb5bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075494, "uuid": "94d03ec8-8eb2-4f9a-acf7-6a07d6bf5051", "comment": "Malware payload (ConnectWise)", "value": "4f807fe41f56a5667ff11cd44c5e1182d559675f8d23f8248adfb3a31afca37b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075494, "uuid": "710be377-7eb6-4ab3-b5f9-7cc7f88b158d", "comment": "Malware payload (ConnectWise)", "value": "7f568c5ab3402cfd25c5c40ae01c3c6bba54062a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075494, "uuid": "38bcf115-5545-4e6c-ad12-eba9790780a6", "comment": "Malware payload (ConnectWise)", "value": "65d5db2635bce956800c1b068517a1f4e083addcb2f6156cbbb03d7af01f100bfd624deab6a3b3d111c13c70aa65ac8f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075494, "uuid": "cd9ed59e-8e84-4af2-8a75-fc45bc3ac7d3", "value": "T172836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075494, "uuid": "4a7fe595-a249-4358-807a-ce22c5e9d69c", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075494, "uuid": "918fbd88-873c-4cf7-b337-c048886c5eaa", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Vk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075494, "uuid": "e7ef627f-dee8-42e7-adff-2397b694be26", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075494, "uuid": "d63beb3a-369d-4c19-8eaa-5712f7729299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075494, "uuid": "87f692ea-550f-40b4-aa7a-2991da291d10", "value": "2c32fc2bcdf7d18eb83f2cd65b8eb5bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c86abe5-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694080340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080340, "uuid": "b0e53a80-5740-45ef-9357-ac1e4e002c46", "comment": "Malware payload", "value": "c4e5211ad58e9998a070a2aa51398c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080340, "uuid": "5f2c9f05-9233-453b-8b1e-ece3820c2ed8", "comment": "Malware payload", "value": "4fe3b75250ba74659a4af9fb3f730c0a023855e30616720ee034e16c3b38bd29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080340, "uuid": "044d9cb9-39a4-43f4-b616-8c1bb76916b1", "comment": "Malware payload", "value": "89c7a96a12cf42fb3d6e9d59b5fa32fad4d1122a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080340, "uuid": "52d0dd88-6693-4275-bd1a-65bb465cc973", "comment": "Malware payload", "value": "d59ddc8cd4a45f29b70fc5231359d1858b810f8e90dfe09e5ffbe627a2fee05d3be9d05e13374c625db875f4056cc642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080340, "uuid": "a1e4a4c4-55cb-4b5c-b6b3-d521763ca4c6", "value": "T15C45F116EBE159F2D56BC13485739262E7B178AC9615832F4F788BA32F237F06E19700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080340, "uuid": "ccd5b4d5-655a-4021-8fc0-6cb777f79509", "value": "8da1b32dabe9c695e3e7c16753a15c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080340, "uuid": "abcd65d6-1d23-4c68-b458-b8483627490c", "value": "24576:+jfeVHiTLHgZJJkF1UfvCGMKsakb/YZGnLhEyKe184:lHiTLHkJkHDNKmzuGnL+yKeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080340, "uuid": "572d6bbe-4ff1-48c2-9590-c6be240a52fd", "value": 1221008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080340, "uuid": "89f356cd-18c2-4085-91c3-b0083b389843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080340, "uuid": "e75bc380-c766-4aca-b179-a3f70a923cb5", "value": "4fe3b75250ba74659a4af9fb3f730c0a023855e30616720ee034e16c3b38bd29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c081f1-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111630, "uuid": "91209a29-2a3c-4c79-bfc2-3fe344f4416d", "comment": "Malware payload (BumbleBee)", "value": "b9a6e994e4940b9483abc3e009840bc1", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111630, "uuid": "814c4b9b-5319-46a7-b69b-5cc4040bc191", "comment": "Malware payload (BumbleBee)", "value": "5024340aa9e2f35324e9355d1aa1ea31c3fe8a2aed1b91f6bd718b77fb35adaa", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111630, "uuid": "1e222a43-7d7c-4a76-8a79-1497a54e1c90", "comment": "Malware payload (BumbleBee)", "value": "83c5604d5ef86da78460729a67880091255c91aa", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111630, "uuid": "55454bdd-a9a7-4544-b524-714b19fe04af", "comment": "Malware payload (BumbleBee)", "value": "0d4aec7d164a4dabf1459684c4579aff9928fe558efa8a40170cf6e4cc1a55714a773ed2cbac22d1dfd2bb5aedc3734b", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111630, "uuid": "8264e86a-59c0-4b35-a8be-feeea3bfbc77", "value": "T19DD4C08FE8A5FFFAC42D51B6C88F02A95263A5802F06493B692D528432D3B4373D775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111630, "uuid": "ccd0aacb-d397-45cd-89a6-9a525a820130", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111630, "uuid": "8a2b0f2e-d8f4-4a1c-a9d7-fb0dcb140503", "value": "12288:tNWJji5RsUeSc7olo68+4Dorb9JIGGnPGo6RRCKEd:UclLlFt4Erbbu6RRCKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111630, "uuid": "8f7d6b60-535b-4a79-9b1b-cdee9963cafb", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111630, "uuid": "87739d67-9876-4f60-a488-f163a9b0b173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111630, "uuid": "4e055823-6ad7-4249-b3d7-2e56e9226e2e", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29825fa-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084806, "uuid": "0d11ec62-e0a0-458f-a2a1-ebde2c6a632d", "comment": "Malware payload", "value": "016ccef9a0a9c791cac093302e395f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084806, "uuid": "85871ee0-6a02-4180-89cc-896e60e88bdf", "comment": "Malware payload", "value": "503c2393aafed36ad772fb7a7b9f73855a5c415babd6cd43d3b45d07653717a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084806, "uuid": "f1d55d7d-4d3d-42fa-a0dc-c505e8528128", "comment": "Malware payload", "value": "16ff11798ac77fce87b4feb3df5eaa620c12694a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084806, "uuid": "78b00c23-aa3e-4837-99ce-a537626fab10", "comment": "Malware payload", "value": "ec3a0a963b926372ae29a361eb8c1537ccc5a4153dafe7149928806b5602c9097a24e1544d5305028390c7ff44d68417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084806, "uuid": "44b8b3c6-0f2f-42eb-9bd4-3f05fddcd7f9", "value": "T18BB423BE6F495BA1DA9103B1222E5CC0314D04F493BAC6D366C8164E9B15FE2CBBF1D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084806, "uuid": "7344ca5d-f867-4c1d-8dce-6e702a4aebd8", "value": "3fd0df5e63af0e5b9d66330851719c2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084806, "uuid": "1bb5ad97-b806-4339-bf3f-aa12ae422f48", "value": "12288:EIlc87eqqV5e+wBV6O+19bP+oKoyanshQlZeNPGWDXlpd:EISqqHeVBxcFW1oyanXZeNdXlpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084806, "uuid": "77e699c9-8175-4d49-b602-fbba29e838a4", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084806, "uuid": "06c28669-c668-4027-9da9-e569d867947b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084806, "uuid": "51437b06-3476-417a-a889-cff1862031e4", "value": "Trojan.Autorun.ATA_virussign.com_016ccef9a0a9c791cac093302e395f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6343d219-4d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WhiteSnakeStealer)", "timestamp": 1694066661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066661, "uuid": "b4f7d3bb-819d-4a67-8971-f713b36ba080", "comment": "Malware payload (WhiteSnakeStealer)", "value": "9d8a624af6cf7f2f8babd700917d554e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066661, "uuid": "22487f06-e8e1-4127-9d7a-a563cb340bc6", "comment": "Malware payload (WhiteSnakeStealer)", "value": "5066eca9c7309af16c882ffae79ceee93d5c8a8bcfe3726455c9b5589a492553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066661, "uuid": "e3f6858c-df69-4dba-bc83-72bb9239b812", "comment": "Malware payload (WhiteSnakeStealer)", "value": "64566b365472f3a168998d34bc5f5ed9f05ed673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066661, "uuid": "322c3bfe-c182-489c-ba03-0d9fca4fc8f4", "comment": "Malware payload (WhiteSnakeStealer)", "value": "7f403e8f0bc32333988ed02fac44d9a5b48bbd4fdbfa7c558f7879b13ad62f3e255654df1f4f0704d7e669701c387b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066661, "uuid": "459852fb-3f36-421e-b1d4-22e4f6915f68", "value": "T125E4E021B585F831D4AA453415D3B2627B287F201BB04ADB970B7E3D5A701D0AAFBE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066661, "uuid": "d7e49bfe-9ac0-4936-9315-d83445b91b49", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066661, "uuid": "533a39d6-c962-4f9a-9be9-2909a9bbcd02", "value": "12288:V9cOGOiD/34hk8O1n5nNXn8laKr9P6VdYnMzszKT:DcbD/3Sk5NinrJvMzsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694066661, "uuid": "cfe0d501-7fcc-48e4-b563-1c0b20306918", "value": 662752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694066661, "uuid": "101e0680-42d1-4ecf-a6ff-045c241eb015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066661, "uuid": "dfb82890-d74d-4a9c-a487-ba0fc96dd4e5", "value": "9d8a624af6cf7f2f8babd700917d554e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005013e4-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694127483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127483, "uuid": "a8533ce2-b9a6-4e82-a2e0-ca68bc881d8e", "comment": "Malware payload (RedLineStealer)", "value": "96b3be22beecf5173fff714258da3f4a", "object_relation": "md5", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127483, "uuid": "71087839-d607-4d2d-a634-c43b97d0c06d", "comment": "Malware payload (RedLineStealer)", "value": "50ccf469215931bdaf5dd6a2b79f28ed4446e9224d6694e1904172c6a40ff5f7", "object_relation": "sha256", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127483, "uuid": "a60fb671-b3b3-457a-95cf-ac81cd477094", "comment": "Malware payload (RedLineStealer)", "value": "dec91544263b54a6881c9aa020eab594c43c62d9", "object_relation": "sha1", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127483, "uuid": "d7e519bf-7de9-4476-8829-1cdeab2455d6", "comment": "Malware payload (RedLineStealer)", "value": "27fffbb15b0d21d33a0d4f7a498dfa0b07d33774c049e7e9f2e10ad9d5cb40c4e22a734e129ef258e036aa680b6ee42f", "object_relation": "sha3-384", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127483, "uuid": "dfef6bad-b6df-494f-9123-0d4d79ddc07d", "value": "T147756D09B2E0DE86C7D91A33906E55684F76D7112737F70B2EA61932BC532E40E8F2D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127483, "uuid": "067e46a6-8208-41e4-b967-16febbf391ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127483, "uuid": "9476e940-af60-4fe0-bbd9-c1a646b9511f", "value": "24576:djddzQlEK9wX2RUFOFSQ2JrxWRSwXRDNqzU3wOF/wSWqH7MvAl:dEJGmkvQNR/9NqzU3lF/Wct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127483, "uuid": "ebf0c93e-0beb-4d1d-9b54-0a867d3d83e7", "value": 1563136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127483, "uuid": "c8f8f0e1-fd45-47b4-8501-82f6860147cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127483, "uuid": "fa056f5c-d2ec-4036-b48b-84919230473c", "value": "1.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beda78f1-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694108046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108046, "uuid": "636ace75-d37c-44e0-b816-f844edec3141", "comment": "Malware payload (Mirai)", "value": "040df8279af3b99466b528e6755f8d52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108046, "uuid": "ee10e120-1327-41b3-b922-161e1458d54f", "comment": "Malware payload (Mirai)", "value": "5109b19698450edabd0b1408691fe1105cb6307c72f2bb492fb39bc415b94da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108046, "uuid": "8d9cf2ee-ba9a-4d1c-968b-b54c3ae7bdaf", "comment": "Malware payload (Mirai)", "value": "a34fb4c61f98112a7f59aa84754ee6ab8760088d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108046, "uuid": "a3ad878d-4623-4555-a70a-cc57a2d2e4b1", "comment": "Malware payload (Mirai)", "value": "991dc24454ad5c3736b85b58d22817780edee703ac97552a1b1ffa2db114e34acdad5fbc2dafc19191dc1574434e622d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108046, "uuid": "6d0a7046-9129-4870-800e-fe891df8f335", "value": "T11B63B6493E319FACFBA9463457B78A21A758238B37E1C5C5D19CE7012F7024E241FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108046, "uuid": "85f7f70d-e2ce-4106-8b94-7d1011d332e1", "value": "768:pd0at5XBUHLM7lLdJfzYVf0ILeyfxls6o6zW77jq0lDaO4b3j+dzqYBD4VgTf7JD:Vt/wCf0NLeahB3j+dzqY5fb7dknevoEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694108046, "uuid": "0d252053-222b-4ffa-b241-2ef50048329a", "value": 72092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694108046, "uuid": "e4f592ae-88e3-4bca-bbe8-ae3319e5ffeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108046, "uuid": "4653ef5a-8ef5-473e-9ea9-51b39a0bd960", "value": "040df8279af3b99466b528e6755f8d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9339eb-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095805, "uuid": "f1ae14f1-3ee4-4f87-88af-aa3d4e1e73d9", "comment": "Malware payload", "value": "b3c8014122cf4fb37f24070a502adab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095805, "uuid": "b9547234-0eb7-4875-b7dc-799a33b27777", "comment": "Malware payload", "value": "51635f8a613a1d7823318453db03d64990bc4d1bbc98cdc2d0fa70f1c70ee1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095805, "uuid": "06d36519-2983-48a3-a4f4-77802765f1ef", "comment": "Malware payload", "value": "a9fbefb9cd7ff833336a23eb9fcf1662f736c491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095805, "uuid": "fe59557b-3470-4f14-af93-f4269bd14069", "comment": "Malware payload", "value": "68c50b79544294cc3c67fbf4719f15ecb011914197065dc78eebe61d1e02f6da31dd9e6fb306f475b3a8bca79e796467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095805, "uuid": "64c4ad10-98cd-4778-958b-fa68293a97aa", "value": "T13C4633784534840BDEE066B8B4EEFC16250A932DB0664B827FAF155A181E17FDF0C7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095805, "uuid": "1c1fbf12-0223-42aa-a05b-a174301cab77", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095805, "uuid": "3586455c-265b-4b5e-8fd5-0d2efde4eba6", "value": "98304:xF2aT72FNf/nm5NhBBeWK7k1kVoszNvT65fW1y7FVhYwTsPvplC:/2MUNf/8N3BXWk1kiszNuNw2Kwyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095805, "uuid": "fd7d7dd5-4798-432f-bb0c-b5677b1e95bd", "value": 5425152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095805, "uuid": "dc0f576a-41cd-4d3c-a68f-46f6f37b15a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095805, "uuid": "5e65ea93-c2ab-465c-aac7-2b8fd515e4b4", "value": "SurfShark_VPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b258011-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694081331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081331, "uuid": "9d92370f-75f3-4df7-9e3f-61cfe9682b34", "comment": "Malware payload (AgentTesla)", "value": "72f29da33f3198a58e406b284a6ea400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081331, "uuid": "ad29cfce-b232-4e15-974a-3205f56d7d0e", "comment": "Malware payload (AgentTesla)", "value": "516ecd2d1c115969a23c1f2e3ea4cd3a4b28e510b8249657f0776e5bee81d9f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081331, "uuid": "90372b7e-d5ad-4019-9e88-7310398f6a1e", "comment": "Malware payload (AgentTesla)", "value": "f7f9ccdafa4c87cd833395d885caf5b70250d9e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081331, "uuid": "cd05f867-4360-4b4b-8e22-f6783f0ba14c", "comment": "Malware payload (AgentTesla)", "value": "512ae68945c62a000041b7cf0ad3d954c3733f482e25c80aabe97de663acee0c6395bc14c15999b178f032a9d002b3c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081331, "uuid": "0e48d49a-7bb9-4e4b-ac83-88fad99f317e", "value": "T159058C3C18BC3223C174F6F69F9CC421F65095AB3D61DE2769C3989A461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081331, "uuid": "944c125a-3504-4277-81ce-4bb5e3e5cce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081331, "uuid": "94cdda0f-afd4-4a65-8b8c-4d3b248bbf5e", "value": "12288:9z8Cjhnjh0aC0Vg0C+vhLl3XnAxo6rvy1KoDL6qZSH0m8ev4M:9zjNnNlPVg0CQhJ3A+LG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081331, "uuid": "bc3ae199-fed2-4b99-8f4b-753cbea50eed", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081331, "uuid": "3b979852-b470-44db-8ff8-5b72ec5fa7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081331, "uuid": "e4c16c69-1512-4fb1-8415-eb9f024f2218", "value": "516ecd2d1c115969a23c1f2e3ea4cd3a4b28e510b8249657f0776e5bee81d9f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4007e3e2-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052428, "uuid": "04f7786c-dc1d-4b7a-93eb-fcd43b58b085", "comment": "Malware payload (Amadey)", "value": "1427a9d67dcf692b2e6428a2fea50f3d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052428, "uuid": "b8e114a1-6460-4c49-8f4e-73cda1554f8d", "comment": "Malware payload (Amadey)", "value": "51e8477d5aff6bf17a1f26167945b8757f000764fd76ac9044219e3e9654972f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052428, "uuid": "1cecffc1-0f5e-4aa4-be26-013f05a14a33", "comment": "Malware payload (Amadey)", "value": "896ca6f81b0c9af78a9c406f11fdaa0c0d78c5aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052428, "uuid": "339656d9-e9a1-4f89-8448-f0342dda1af5", "comment": "Malware payload (Amadey)", "value": "9433000dbd493316839ba8055f219b38dbe3b7db6b79b52bb7b5a1a34548e1c17157552054400b59722219306cb05e30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052428, "uuid": "51f6096c-ac9b-4932-8709-4c69df51527c", "value": "T11BE41212BBD8D063DDF05B7129F107C31A32BDD08A74837A23897D5E4C72A95A835B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052428, "uuid": "8ffb0689-a9f8-46d8-93a0-596c49fc6aa1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052428, "uuid": "b6d6fd31-f2b9-415c-9f42-642150eb80fb", "value": "12288:9MrIy90iTN+w4VrOIrgVaT5JsExlxLYsRmrXffzOW2YWJZF:lyfMgVafNlBdRKOW2YWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052428, "uuid": "70bb0fce-5e17-43eb-a93f-a089b35572dd", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052428, "uuid": "61f1f0c9-24e4-41fb-b5fb-4c4a35cee016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052428, "uuid": "d31e23eb-6ae0-4abb-a7b4-b457b9ddc1c5", "value": "51e8477d5aff6bf17a1f26167945b8757f000764fd76a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269f548e-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694085457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085457, "uuid": "6e5373a8-13e8-470f-866a-2416b100d795", "comment": "Malware payload (RedLineStealer)", "value": "6c985a0000c82dcddf98bd460f068c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085457, "uuid": "b3dc5a57-b308-41ca-8ac3-9595a8259193", "comment": "Malware payload (RedLineStealer)", "value": "51effd873582cae518e49918c2eb6dc2490b7c73505f34bdb61536d8491db256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085457, "uuid": "22267153-5f93-41b5-aa8d-168d8bbe7771", "comment": "Malware payload (RedLineStealer)", "value": "413059c93eee26fe24a78849865b53e5bd57d689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085457, "uuid": "3f681048-c414-4907-bfea-bc864568a123", "comment": "Malware payload (RedLineStealer)", "value": "9b6a0e09f820850c3fde7653b67aea3eadf18603e87f97e8430d44727448d490a3a7c882bcbc4c8460020ff6dbd2b5f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085457, "uuid": "11342657-57bc-4de7-b18d-c0dcd22c0678", "value": "T1F2447D1074F580B1C536123197E787E0593CAF608AA1CDFB2B95DEAF7E303919B34A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085457, "uuid": "0c3bc0b9-e728-4a51-8011-9758a53be1fe", "value": "b54c77155566d77775e85f5f400b5a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085457, "uuid": "566b235b-793e-4d81-81fa-ab418f30ef9f", "value": "6144:DMkCv2ANGzuCdvsvgfE9J/1nAAObVEgMkbR9gdn9/B:DoOaGzugkKMgZlm9/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085457, "uuid": "021ea0fe-f31f-43ec-b9ed-046421b8ae40", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085457, "uuid": "ad74b773-c902-4184-8ffa-8708cc7a1ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085457, "uuid": "59c61837-03a1-48ca-947f-46f82feb732e", "value": "6c985a0000c82dcddf98bd460f068c6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9dcd46-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111618, "uuid": "ce4c7500-d4dc-497f-8ead-367230c8ef57", "comment": "Malware payload (BumbleBee)", "value": "90e87dfda4476252cce4e127d08e8d5d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111618, "uuid": "fdad83bf-6b23-457a-8803-c95d295208b9", "comment": "Malware payload (BumbleBee)", "value": "5220d214e0b9907e11649d686b7f98dfe93d7b2947a4423fb98161ed0620406f", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111618, "uuid": "956c1a0a-d23d-4b4d-bf21-e2e26d7e4197", "comment": "Malware payload (BumbleBee)", "value": "8310354ae63df1ab3b28306284d8984c6a08b561", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111618, "uuid": "f9afc898-30d1-43c1-adc8-a6b34525b4c0", "comment": "Malware payload (BumbleBee)", "value": "2fea95fa9a97ba846bf5131bd522d7c31449e3e2e9bbf63e97344f3af5f0b2a5b8c4ce4eba146058afbbaec0841549a9", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111618, "uuid": "7d64ac29-338a-46b8-9dba-c7f5dc18e744", "value": "T1E0D4C08FEDA1BFFAC45D01B7C88F06A956A3A5802E06083B552D128532E3B5373E775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111618, "uuid": "ac46aa0b-616f-4eda-9e6f-efdf6f3c09c1", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111618, "uuid": "0d2e0f14-f024-43af-a168-6e3f26d96b7d", "value": "12288:FaMVKUTv/yu8us0amwP6Cn+8plcAZewlC9dtn7:IqKuXb20amwnn+6Ywyd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111618, "uuid": "d2bd4a93-5ab4-4a0c-a316-33d82e462f33", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111618, "uuid": "a49edfda-6b9f-4e9e-9708-0b49fce9cfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111618, "uuid": "ed76461e-1188-489f-b81a-d299589ebe81", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cbb31b-4d53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694073128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073128, "uuid": "f89bf322-1a09-4aed-82c4-6d29a3857671", "comment": "Malware payload (RedLineStealer)", "value": "a796293813ef18dfec721061d7299814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073128, "uuid": "23e88f7d-2bc6-4b36-914c-95fadbd329c3", "comment": "Malware payload (RedLineStealer)", "value": "53842278c9c63dad817b638f9f9e06d76493c646dea69b7df62ee142381ac4d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073128, "uuid": "442dbebd-cf50-468e-a50e-f8de57cc9690", "comment": "Malware payload (RedLineStealer)", "value": "497ec5e92c93d43ec5f98c6d9fe38d6e1eb6a8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694073128, "uuid": "5a9fa9a8-42b2-4bfb-bb32-3ec14b71593a", "comment": "Malware payload (RedLineStealer)", "value": "58fdb3449afa02734918c34e4200f4a4f845828c0780938bebefb1e2057f5a4a2319efa1cbc60f33bb3bdc1917483614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073128, "uuid": "02478076-dc31-46fd-a204-8baa5d69c7cd", "value": "T1D5E41227EEE48436E9B647B41CFA07C31B3ABC604D34865B2746AC4E1D73AD0653636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073128, "uuid": "63565b41-2a2a-423f-a4e9-11ad5712c0cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073128, "uuid": "e5f87069-4758-46da-bbe1-63aafc1c6508", "value": "12288:AMrIy90qsb+7HS2qB3D7giMZdaEr8fwRmrUnbA4fol:Yy9nSVFkiAaw8fwtU4wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694073128, "uuid": "63b6b686-c9a0-4381-be42-1c69f29fc078", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694073128, "uuid": "8598389d-551f-472d-a011-af7a582fefc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694073128, "uuid": "e0431fcb-dd6f-4bdc-beca-13564fd6caa9", "value": "a796293813ef18dfec721061d7299814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a89c47-4d22-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052092, "uuid": "9f4b4439-88ea-4a0e-8f2c-40d4dc6225d0", "comment": "Malware payload (Amadey)", "value": "87f215e2b1849ad673a4be72a73d4443", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052092, "uuid": "8641a925-1a4a-4a05-b074-8c4f6cc0aca1", "comment": "Malware payload (Amadey)", "value": "541a2360ea6ebc2a0fd02d8d21e3d87a85e3f3c215d6a8cc1d122f13a8d4e49c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052092, "uuid": "437de93e-e1b0-4e54-b496-ffc9fb7f7ecf", "comment": "Malware payload (Amadey)", "value": "4c0c65a4d11998fec7a614cdbd17861a75f330ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052092, "uuid": "4e8751bb-6ec4-4a3e-b2b8-508ece74d83f", "comment": "Malware payload (Amadey)", "value": "005f11fd2905830c530b103a24842712a3346c14634d5348873dfb1ad39d03f6d13cbc502bbffc7113b8f20ff65ce046", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052092, "uuid": "eddfd69b-2926-450f-b208-13973159ba83", "value": "T15724F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052092, "uuid": "db23e51d-8aa1-4564-a29f-e1f15aec3964", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052092, "uuid": "e4b12726-017c-43ae-945f-f778c1e7ff5b", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052092, "uuid": "ff3f305b-5fdb-41c2-86e4-797b1d296314", "value": 225461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052092, "uuid": "e0a8f73f-fb18-4f31-b47a-b51fb4358d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052092, "uuid": "98bc7b00-3f9f-4934-bfb7-245516067776", "value": "87f215e2b1849ad673a4be72a73d4443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f9305e-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103844, "uuid": "e4658955-3d23-4761-bcba-f459a2ae49bf", "comment": "Malware payload", "value": "79f1a80893d97765ed399b3b006689e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103844, "uuid": "5a59c54d-5ce2-4806-9297-6ba9b664814e", "comment": "Malware payload", "value": "54a477f68ee0f09eb5b30d5ec19be8e74ef886d74c63de4ee063a2f0a23342e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103844, "uuid": "a4719a17-c9c8-4e2b-9b2b-0e7da01e91d4", "comment": "Malware payload", "value": "22485d6bc74fb089955a50e0671e2e6a7811a2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103844, "uuid": "feec045a-b4ee-42b5-bf1c-e8c7f89a93fa", "comment": "Malware payload", "value": "7aee7a834de19c2ce8d3d720141ba94fbb37b464b421bb2431e5f53e1e920f53fc94464aa61faef39c73ab08e9787d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103844, "uuid": "77ca61f5-6f96-4153-8a2f-88526954266f", "value": "T1E9553341D724D5B1C2E8DEF1ADDD46494A32FA2F282C1C4D768F1E1A2FBF0512469B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103844, "uuid": "ec773daf-6565-40af-8564-b404a9004da2", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103844, "uuid": "e3d98302-1639-48d2-aac1-3f7924eefbfb", "value": "24576:oI39dX7jFzSnwHOne2dsI2ky6cza6cO97b3f0xiDIud7HehgebVKoyInpD:o6dX7jFzeiOnbuky60P33oux8VbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103844, "uuid": "f1ef888f-31fe-4a14-b145-37c073fed3ca", "value": 1288529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103844, "uuid": "59a0285c-9ed9-4661-9b62-0d4199d88abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103844, "uuid": "58b5641c-0e67-4563-971a-79f33834a888", "value": "79f1a80893d97765ed399b3b006689e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e23b3b2-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067887, "uuid": "8394aea2-549e-44bf-ba24-581a1fa34c70", "comment": "Malware payload (SnakeKeylogger)", "value": "7bddbdd56278a492a58d007b0fb1d110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067887, "uuid": "0662926a-9714-41d2-914a-b204b352c0d7", "comment": "Malware payload (SnakeKeylogger)", "value": "553d3053ad2d794d4e2bf6674ac43549838ab6570b47d6e28ec594bd02ba4d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067887, "uuid": "61014a1c-7216-4b96-b091-449dd85fa99e", "comment": "Malware payload (SnakeKeylogger)", "value": "cbf646bfd9265c9360f8733cffde595364e247ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067887, "uuid": "a0cd50a0-b479-4a5c-ad49-74712d092f5f", "comment": "Malware payload (SnakeKeylogger)", "value": "5465ca9992c8bcbf0acc4e588be509804f222ea7efb9414c475a8baf8b6538e24c9d73d80972d065a8b2fb3c68f536b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067887, "uuid": "3f3a5253-73c0-4084-b94d-f1166efd9193", "value": "T1482563FC5CFC1136D9A0EE908ED9851BB1C0A57FF285AC1D97E20B650252A4AF88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067887, "uuid": "efbc5a5f-1f44-433c-a189-0bad1baf5029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067887, "uuid": "64bda443-7acb-45ff-a956-db6483387997", "value": "12288:7jQewAMjSsS+KEMmWmAk/iC1GwKwJArrSPzNRzobM2EPG3vYiK:7ZtMji+yZmvKwJ9NRIM273vYiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067887, "uuid": "66c02c0b-567b-4cfe-aa7c-e5479c9365d1", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067887, "uuid": "b46c998b-9918-4526-bb1d-6fcdf6f24e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067887, "uuid": "49d882a4-2da7-43f2-bdae-e8c79623f4fb", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b873f3-4d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694045170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045170, "uuid": "751c1dc0-7f91-49e2-97fc-619fa4a6fcc5", "comment": "Malware payload (Amadey)", "value": "67035fbc8f2867de49d32779a78b5428", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045170, "uuid": "d445d866-a5fa-428c-b8b8-7140ba4144d7", "comment": "Malware payload (Amadey)", "value": "55d0a159b882b31da81ce0dc805cb1cb4d086002c5f973be940c622490ad126b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045170, "uuid": "23f1c5fb-7ded-4045-94f6-fcb63397423c", "comment": "Malware payload (Amadey)", "value": "7dab406d382f782a4c70917a33667961c22a3a80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045170, "uuid": "82db42d1-a5c8-4c3d-a360-11c28c86b687", "comment": "Malware payload (Amadey)", "value": "1737283b941ef7512b9477c459f24dc58346c8556817c40727d2c6fc2f5269e8e7f1d644a96da85b29c2fbf8700ec982", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045170, "uuid": "1958ed6a-35ec-4bef-a396-96878cf16290", "value": "T1B1E41203EAD88037D9F52B7098F207134F3A3DA29DB452AA3795AA5B5D33790A131737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045170, "uuid": "b13343d7-eb75-4a0f-9bb4-10e0d0014102", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045170, "uuid": "fd34c5e7-5516-482e-80c2-5227b47cc6e1", "value": "12288:JMrIy90F7FrKrO7LRz1WECuaVNqr7A9zzkAfJzUjfEqO0+Fcxv3nOwn6rII:lyGJF79RfRUcryVJkQGGwnKII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694045170, "uuid": "60db2c51-22c3-4e7a-97e2-bb87e71f584e", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694045170, "uuid": "44da83e2-a167-49d7-959a-62216efd4b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045170, "uuid": "c06c76f4-18dd-4001-bd90-1649f9ef428e", "value": "55d0a159b882b31da81ce0dc805cb1cb4d086002c5f97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a435d6d-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075558, "uuid": "1097e2c2-25d9-4692-b3a0-27827775cea7", "comment": "Malware payload (ConnectWise)", "value": "9ac6b23ce41d41f57ac78fe9140a7aca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075558, "uuid": "f55a1a38-0e24-42bd-bbf1-e5865c24658b", "comment": "Malware payload (ConnectWise)", "value": "57866eb69858d2ca741f9eaaf93e86ea8f3307b9f23eb51647452486c33d95a8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075558, "uuid": "aa714e6b-58f3-4182-950b-399d36cd5961", "comment": "Malware payload (ConnectWise)", "value": "d2d72b3e6eb2ff30864a899b537cf00307723951", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075558, "uuid": "a8443f35-a184-453b-85ad-5e9a7a4f2861", "comment": "Malware payload (ConnectWise)", "value": "72950585e503ac33d1ffa044e6472e913531de4246612d3f8e928f1f4cf2a3518e76e0282fc6e068989c0f18261bb521", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075558, "uuid": "ac5e8f2f-c373-4e3b-8454-378e95c86d3a", "value": "T127836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075558, "uuid": "0dd646fe-8a13-4356-90e7-7fde1eba6411", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075558, "uuid": "de8846ce-e84f-40a5-a074-f5eca32ee158", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3rk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075558, "uuid": "ec58a1a1-88ed-4286-8195-8245b489b5c3", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075558, "uuid": "e2e5d91d-512b-4277-b0cc-749929bc82dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075558, "uuid": "748f7ce3-9210-4ff6-ab3a-a484d7ee7eec", "value": "9ac6b23ce41d41f57ac78fe9140a7aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467c5a29-4dce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694125883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125883, "uuid": "22dc8903-5890-4a88-9641-4799c8f664fe", "comment": "Malware payload", "value": "a34f9bc862e0dbbb16993d00fb82c8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125883, "uuid": "ee922e45-0c14-4844-90a0-98cde9fe8b95", "comment": "Malware payload", "value": "5801d463b4b0bf5fbed2ceb867d93b03817dd06e30f73f821827d835ff85d5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125883, "uuid": "833cf45d-cbd5-4a32-8635-9b838ff1a68b", "comment": "Malware payload", "value": "e530a38b29f3b1b1da1f45cba858b632becdefde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125883, "uuid": "a1f6cc15-7d99-4221-abdd-3f83ec1015b0", "comment": "Malware payload", "value": "c8179818e23fd3550bd034bff12feee7576035f1b0cf0353cf7cac00025d429288eb6d01e8412cbee3716bba2c30aa21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125883, "uuid": "7c94ec24-0986-40e0-b251-8c8d43d728f8", "value": "T1B416187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125883, "uuid": "9c130958-e3a9-4f11-a8a6-c8061067ce53", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125883, "uuid": "1d29a640-f2a7-4371-bef3-90c80087f797", "value": "49152:Jgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWAjXNO:1a71fUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694125883, "uuid": "467960d2-dd57-464b-9114-9cc8e535bef5", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694125883, "uuid": "c1052c64-b34c-4151-af13-884c154e39e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125883, "uuid": "764ba10f-30b5-4a7d-9773-4ae6b9b56776", "value": "SecuriteInfo.com.Trojan.Packed2.45650.25243.29960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95e7c63-4d7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092172, "uuid": "fe9cb9ce-19fc-4c06-a697-882544fa64f0", "comment": "Malware payload (AgentTesla)", "value": "34b640854f3bcef78f25df1704f70132", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092172, "uuid": "71a4981f-2d7a-455c-bf4b-98c40c53d517", "comment": "Malware payload (AgentTesla)", "value": "580e9a403ba5923d9efd54ef7f708e0adea2615936cfad7caa1ef38524d50559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092172, "uuid": "a6211ec0-f480-460b-bf71-df45aa9774a6", "comment": "Malware payload (AgentTesla)", "value": "f2e7ce876c82be19e4aa8a4ba5a5131067acad71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092172, "uuid": "c22a3724-dc3d-4a20-a142-5f94b7841eb6", "comment": "Malware payload (AgentTesla)", "value": "cce0d82e64b385e9ce643937886f833eb6935b2d0acc490638d9f7b9ccf7a84d4626bf8d0e759dc97798408f07303cda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092172, "uuid": "90c21c72-d520-484e-96fc-1912e61ed8bc", "value": "T1FB949503BA8EC9F1E2891B36C5C7D01817F5D686B3BBDB0B798A2365484377ADC49607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092172, "uuid": "41f0b52d-7002-4a34-8c1d-1cbc33ba340c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092172, "uuid": "d5aafe29-5d34-409e-9b8a-f3dddb8c7fbc", "value": "12288:ZmzP1lBS1XOD/IKqNqm7tXSJu5DZCvJo:ZyxbDIrqm7tXN51CvJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092172, "uuid": "c37b33a8-bbb1-49aa-a371-9882fa3306ee", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092172, "uuid": "ee1c5549-9394-4979-a6a2-c1663eaa5603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092172, "uuid": "c4007699-3cd5-48a7-a7ef-ed70c4b080a2", "value": "2859531946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6e968a-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075665, "uuid": "ce35c4a1-86b9-466f-b781-86a3c93728f4", "comment": "Malware payload (ConnectWise)", "value": "920b3bd0a75f15f36d36c940d8ddc483", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075665, "uuid": "597f5a82-956b-4b79-8482-cb183d698f1a", "comment": "Malware payload (ConnectWise)", "value": "580f6086d9efc3e2c3006be026009de40b8f81b6c65eecd6aad5d4b242122be3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075665, "uuid": "8f17afd9-19ae-496b-8b75-ec1b7a04c7dc", "comment": "Malware payload (ConnectWise)", "value": "55da0a5ea2e83f06a79dbe29dcd9f5b66924752a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075665, "uuid": "b7139c9c-e018-45fe-9841-b191dd30ef38", "comment": "Malware payload (ConnectWise)", "value": "2779872e526db250e18d260d2cca091e78772362e3bf5b02f630560208991e98c8330873bdac3dbdbf417b92f04990c2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075665, "uuid": "0a940bfb-2c34-42f0-a4c3-9a2aa1adfa5c", "value": "T101836B13B5D18475E8B30E3118B1D9B4593F7D114E648EAB2398427E0F352D1AE3AEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075665, "uuid": "42dbb1e9-f8ad-43f3-8c56-fd571d1ed9f0", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075665, "uuid": "180399be-fdd5-44a3-8e36-bf049d72e222", "value": "1536:EazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QtPx1:QFNpo6rIKlUE8fbkqRfbaQlaYY2Kx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075665, "uuid": "d30ec394-36d6-4107-a7a0-c8e0704949a0", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075665, "uuid": "d9dae054-82ae-46b1-86a4-c9ca0ad25fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075665, "uuid": "660e4b06-ae94-4b70-87eb-f79c6afea18c", "value": "920b3bd0a75f15f36d36c940d8ddc483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbc9dd1-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694090730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090730, "uuid": "2223636d-5ded-4456-809b-db3117d12db3", "comment": "Malware payload (AgentTesla)", "value": "b719fd07b3c6631dcc61bff0e8588489", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090730, "uuid": "8ffe2fef-a5cd-4df8-8f65-cab49467f2fb", "comment": "Malware payload (AgentTesla)", "value": "589999aaa2213218a961ade7f48566476d8e78720a8e6051ed3d0bd1fa761e4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090730, "uuid": "6b87360f-fb92-4908-8e07-66a917113d98", "comment": "Malware payload (AgentTesla)", "value": "bbc89688f4cb22a298e44b903d8b1831a127eaf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090730, "uuid": "bf336cc0-1b8e-4e2f-9bf5-305c0b8484a9", "comment": "Malware payload (AgentTesla)", "value": "faf575d38da8928830ba1425e4116089b444994ed0c64d476985cc9a9b75fcdfe0a00ddaaaf07da77f5b51b6cdf90abe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090730, "uuid": "4691891e-8a6e-45cf-8a8c-5cda5724c8ea", "value": "T144337B2CC34F02A9CF5252779B1A4E4442BDBB3EB38552B2346C437533EE92D51262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090730, "uuid": "603fdd85-c2ca-4b3d-98ea-e3f71dd7bad0", "value": "768:pwAbZSibMX9gRWjiRLxUS7jD3HSRPX0S5xyqB:pwAlRRPU4jDCR/0S5xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090730, "uuid": "ba4a46c5-9e1e-43f5-8d7b-0df8a80b169d", "value": 52706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090730, "uuid": "7e0d5e12-f878-4cdb-a6bd-45d759f97385", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090730, "uuid": "a667c06d-0809-458a-924f-8491242d0d75", "value": "b719fd07b3c6631dcc61bff0e8588489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d287813f-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084886, "uuid": "b357461f-6a40-4c8b-bfca-0891923525be", "comment": "Malware payload", "value": "6482172861f498a2c66f3ef306836e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084886, "uuid": "b13df4d8-1c33-45e1-8b7c-8fabb5431e48", "comment": "Malware payload", "value": "58ae584470a61f3225e8d5ad1d7359f0a132a81438ff8fc427a42ba41feaf040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084886, "uuid": "013c0441-cae0-47b9-8b8c-942076a04151", "comment": "Malware payload", "value": "709a9da2cf3f41b96380c3fa000ef708467356f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084886, "uuid": "9078fe45-104b-4005-952c-2455660dcd73", "comment": "Malware payload", "value": "2a7382f46096340782869583b7b6df092f5a0febab2d66dd4c53df113a8df612882cda5cadfb474521d9ca50f6dd4309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084886, "uuid": "b1261b97-422d-4436-99df-b658e4dab3d2", "value": "T13D34C0C46692D149D2FA957F14F67E188A20FC954A108AF273C9353E2DE74EC19CA83F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084886, "uuid": "96505fb7-31e8-40e7-9bdc-752a9049a966", "value": "4517235d6f012421e28370dfa4e6f8c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084886, "uuid": "e94630cd-ccbc-4dff-8fd3-bfbc88333b1f", "value": "6144:cZSE8UGJwiYwUfWeR7oHYnOW111mFW+9k3:E3GFY/jWHYt1yW+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084886, "uuid": "cd77de8b-2f02-4971-863e-72ce74cc3217", "value": 252361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084886, "uuid": "e6186cc0-2c95-4d69-9e48-0aafe7f3bdc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084886, "uuid": "4e7f39b4-5ee0-4e90-96ca-82c40e322e5b", "value": "Virus.Sysbot.ATA_virussign.com_6482172861f498a2c66f3ef306836e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898c4812-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1694083046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083046, "uuid": "b60f1211-6808-4d75-aaa9-878ae27b143d", "comment": "Malware payload (ModiLoader)", "value": "e9a80a721124d0b32a3d29b4f848022c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083046, "uuid": "c84c9ed7-d414-4dda-9d15-0dc4b6a28fb6", "comment": "Malware payload (ModiLoader)", "value": "58fb3fb48ef9fad1b1db3d84e7319e3536ada43191282424b436d2b426dcff30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083046, "uuid": "64f0b641-9a5e-4357-a027-cfd3ec8c9730", "comment": "Malware payload (ModiLoader)", "value": "e64ff42628b1ecadde366863bacd75ad684abf25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083046, "uuid": "1beb9e34-84df-44fd-961c-f2c914ebee8a", "comment": "Malware payload (ModiLoader)", "value": "8a008e55316001b3df9402ab429080bae6a042de3b40607e1cda9acd39de741add6f83f20c47757443a7de1dd172877f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083046, "uuid": "2aa179a8-32f8-4ea6-97ea-146dbeda9986", "value": "T16455D03677811032C256263599AB8B249C39BE103E0865AF77F87DCC7F76683B8161F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083046, "uuid": "be7bf4ba-fac1-4a3e-a771-cc76cd29f74b", "value": "05f4f91aa1809de9cc9e340317e84db3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083046, "uuid": "30e62714-31f3-4f56-95b3-80648500eb39", "value": "12288:vmqWab9vmCM3PYAQ/goAL2k0jluBjXjFhGHxWgyFaB3ZwveR8VOBUGTZL1z559ts:vtWkmdfWvxSr9aBB8sN52OJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083046, "uuid": "9cd5a4a7-0cb2-4a6f-bd63-75c7af0f8892", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083046, "uuid": "114df1a8-c9ae-4cb9-ae42-325bfe3adf7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083046, "uuid": "bd11cdf5-0a43-41c0-a3b0-4adc2cc39aa8", "value": "58fb3fb48ef9fad1b1db3d84e7319e3536ada43191282424b436d2b426dcff30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770eab8d-4d4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071419, "uuid": "5bdea664-71c7-4a63-a656-b779adf6aab8", "comment": "Malware payload (Mirai)", "value": "8562dec50e8edd0d67accf3b2604d572", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071419, "uuid": "2568989e-4c73-4ce9-93a6-8be9972de244", "comment": "Malware payload (Mirai)", "value": "592266cb24cf37ae497e52b5bd1e03f56f629762520d3a27ffb822ffa7a00e76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071419, "uuid": "cc9f7b13-186e-4c13-bd4d-e034d51d341b", "comment": "Malware payload (Mirai)", "value": "3d7cf01533a608168f6004a140136a11b6528a58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071419, "uuid": "8704d111-00a5-4240-a2a1-2f6b57e38a1d", "comment": "Malware payload (Mirai)", "value": "376bb39864ab31f872a90b591c001657dd6627e58952c75d0af96b9505a54986f99a20fb9fdf710e4fb0e868401046d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071419, "uuid": "a2e37bf2-c0bf-4d2e-9a5b-fa49eade4b38", "value": "T1EED2E02CD65D7D05D6AD3DB914CE46F9388CB080636DA98E1B224448FA27E9BFC071F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071419, "uuid": "32b66799-a920-4a47-a78d-a0d4fc6d97b6", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNwQ6IhBJbiWUK:1bDs06t4BEub4sU/MbUyIhBmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071419, "uuid": "075d61ce-0dba-4431-b7f4-4243f65aacfe", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071419, "uuid": "609dded6-ba82-48c2-bca5-ebeb8db33412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071419, "uuid": "ac165bc2-f1d3-48f4-a531-a162c0282c6a", "value": "8562dec50e8edd0d67accf3b2604d572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f78da0-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075812, "uuid": "68e87c1c-2b36-445d-9e2d-a19142387d3c", "comment": "Malware payload (ConnectWise)", "value": "5319393f28d7250d742f4481c4be28d4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075812, "uuid": "bb194217-e5fd-4184-abaf-86ecc0e1f42d", "comment": "Malware payload (ConnectWise)", "value": "598330124d46795d665ddf1ac12d0c014c63b0d2240b187a44547a06454334da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075812, "uuid": "41a78961-db16-47e1-9bec-971825bd9cc7", "comment": "Malware payload (ConnectWise)", "value": "14e8b4ad0646beac9296d1ba4c2646836f08e47d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075812, "uuid": "67008449-0a87-49e8-831f-dabb8844e093", "comment": "Malware payload (ConnectWise)", "value": "d5a52e7be2ea8b8ffb406f03263bb3d176bf8c0557c00ae7ee13f1340e768f369dcab136b3a0a38e51b0d8022e10bf87", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075812, "uuid": "b1b81c36-7dbd-49ea-a130-1c8d6058801f", "value": "T16A836B13B4D18475E8720E3118B5D9F4993F7E114E648EAF2398426E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075812, "uuid": "b52f7afd-2db7-406e-9a98-bc33f3af20ba", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075812, "uuid": "35cee7fc-d1e2-4046-944f-31d20db6ac10", "value": "1536:mazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYh709Px30SI:6FNpo6rIKlUE8fbkqRfbaQlaYYhYxESI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075812, "uuid": "ba089a64-e6f2-4f51-bf2c-3535ab59f674", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075812, "uuid": "01fa130c-e91e-47ee-9481-9180f49709bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075812, "uuid": "6d22c42a-7749-42b9-9d66-45bbff57b73d", "value": "5319393f28d7250d742f4481c4be28d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e6503c-4d73-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694087016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087016, "uuid": "243e76c8-16da-49be-a0cd-1366bdfe38d9", "comment": "Malware payload", "value": "5a928539c1ae14f183ab716452074018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087016, "uuid": "13aaf8f6-2a8b-4370-b349-708b326e36f0", "comment": "Malware payload", "value": "59b610b8a72c729bd22e29c0c5b171d85dadf7533d94be53729c23b65991c9c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087016, "uuid": "c9516e75-def2-4da9-89be-7c8749b5dd91", "comment": "Malware payload", "value": "450a0a2a1a1fe9391dcaaaaeac1c931a590f6f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694087016, "uuid": "3ed7a465-9b3b-4323-9188-0154fb803b93", "comment": "Malware payload", "value": "8f35ba61807df6a3b6e42bfdc924b240a256801fdb9e2d7ff8160f75d3cf04f311c77ccaa19a38ec6905cc02390c24c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087016, "uuid": "624fb57c-a7dd-4126-9665-f2cb6dd22f84", "value": "T18E7482452E8CE131DE7016BF2CA916BD6ED14BE9E22238C2D794D15F09DFB2009EF5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087016, "uuid": "a5bef859-df45-4407-80b7-8ef1a89226f4", "value": "a80c2db75935166d745b577697f4a7cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087016, "uuid": "4bef697e-c6ea-4235-9bef-31f7bf3482cf", "value": "3072:fYUb5QoJ4g+m0i6ADZj6Iz1ZdW4SrO7FSVpESocc/0m5:fYM0rADh6SZI4z7FSVpBM/P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694087016, "uuid": "8d3e8617-d24e-4be8-94f6-baf80180d5ad", "value": 337607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694087016, "uuid": "5df209b3-a008-49d3-b299-be9c332a06ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694087016, "uuid": "c8defd74-29d2-4b49-b69d-1f07def97bf8", "value": "Trojan.Autorun.ATA_virussign.com_5a928539c1ae14f183ab716452074018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f3483c-4d97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694102262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102262, "uuid": "d1d2d594-a34e-4f46-9abb-0d769246f48f", "comment": "Malware payload (MysticStealer)", "value": "f8a572a7b2306922bd4f6db87ee3c3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102262, "uuid": "07c507a7-e1de-4c83-84ff-0513c8504518", "comment": "Malware payload (MysticStealer)", "value": "5a18bae5dc722829247af597e37dc218ae8efebd44f8e4af8773279172f9a655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102262, "uuid": "17e5365e-f233-4d8c-b7be-3a0d477300ce", "comment": "Malware payload (MysticStealer)", "value": "a27435e609603acb142708507f08a7de86cb0751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102262, "uuid": "5fcd8929-de86-43d4-83e9-02bfb594618a", "comment": "Malware payload (MysticStealer)", "value": "45895b056819a12371136c79f0b6380bcfb0a9f93226c868d1d9e9f524a2fa2171b6186e0a8bd6a01cc29c61349360fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102262, "uuid": "d786fe9c-4cc1-48ad-8894-621943b64aae", "value": "T104856C10BB919128FCF701FB4AFE20AD953CFAA00B5894D751C42AEE8629BE17D31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102262, "uuid": "aed24f3b-f0dc-43a7-ac18-ba64ae5b617c", "value": "c7052db0d8529f27030da22f4c75bea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102262, "uuid": "56ac7463-c674-442d-9d34-6188d58a7467", "value": "24576:jkr2TNq1SnTAAxUfX1cw4bYTfFG6SViGev:HQ1yTAAhb4AiRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102262, "uuid": "1c9ce315-5605-4456-a4a5-19d118f6d8d3", "value": 1776640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102262, "uuid": "fdeef110-3a93-4d73-a799-9a126c0b5d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102262, "uuid": "54437859-c107-4217-9c33-efc0fb929ea4", "value": "f8a572a7b2306922bd4f6db87ee3c3d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ae5c79-4db1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694113561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113561, "uuid": "9cc5cc3b-34a6-4864-b33a-e9fcb6e9394d", "comment": "Malware payload", "value": "eb50bc88a4dfdebe40af75c9ac8923b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113561, "uuid": "22e57459-6e79-4780-8c08-2ad7c7d7ef1d", "comment": "Malware payload", "value": "5a8f0b214309e35d72286d0550bb14d96b834b2987700d42c9ff65aba42f14aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113561, "uuid": "a9894f7a-4753-44f7-9cba-9f47c18c7008", "comment": "Malware payload", "value": "e4dae34f410c64c63fc82ffbbc50f42b8e885d18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113561, "uuid": "f3a4b933-1b0c-4c25-ad47-0859aabbcc5e", "comment": "Malware payload", "value": "a965e62f61fd00fa0ab1b6def4bf7e84d3d1df22f5aae4112072d00eade38d2c547794cd7c8ec8e6e911642f24e59670", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113561, "uuid": "dc42f567-aaa0-4858-87b6-6901e2562693", "value": "T18D03E19FCD616589CD9C2D7B831A771A58097488B2C295FC63A12E0C9753E4BF7CB0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113561, "uuid": "fcad8493-2899-4e6b-a816-c67dc1b88cdf", "value": "768:hu+dhF07pnbFokdbXLk35zvXLjHMjD7qbtYs5QmPkRjBWTNb:h1j2VF9XUvWGb6PgNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694113561, "uuid": "a7bf0bc8-b653-44b0-807f-04f3ca5bcb9c", "value": 39800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694113561, "uuid": "194a8182-5942-46ba-9c92-e1dc46eee016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113561, "uuid": "b17f4db7-4929-4e1f-8b5f-9834ec8b7f0b", "value": "eb50bc88a4dfdebe40af75c9ac8923b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afbd64e-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122159, "uuid": "b630d852-a830-4f91-91a6-f52ab2ecd5d2", "comment": "Malware payload (Mirai)", "value": "8305a00298d02758e3b848c7ee57086f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122159, "uuid": "a1f35cdf-187e-476d-8cdc-b63fc0426e3f", "comment": "Malware payload (Mirai)", "value": "5b777a8a95d8d6ad5339ee26c51343aec9df51ad70a574d6f924677b046d2888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122159, "uuid": "4c1c067f-1f95-4a80-bd55-2d323e857f12", "comment": "Malware payload (Mirai)", "value": "2bd0f7ad9b073b127decc7cbb45067ecb9f42f44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122159, "uuid": "7963689f-ae2c-469b-b51f-d4267cd5cca7", "comment": "Malware payload (Mirai)", "value": "8b967a930084b34890f96b22685942820d7d9d8fa68a2943f3d3e308c2fde6e5525042b34d463b8515af8b35337af193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122159, "uuid": "c1a4985a-8427-40bc-9c38-9a6eef1f93b7", "value": "T192C2E1BC7EEB6F83CE1700356998EE3746F0A5A5D39B7297B2454002AC130E57B26CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122159, "uuid": "fde2a3b3-e31f-4711-a25f-2bcf724da7b5", "value": "384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjZF0G:qMw4DZdFbBy6x3K/KdWnH5QF0D2I0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122159, "uuid": "72da4e55-6dd5-405d-9684-f2aef3fa0f25", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122159, "uuid": "6a8f8185-42c0-42ee-b9d0-e7c412a8662a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122159, "uuid": "57e4f030-02ee-4601-b419-06b4433d6668", "value": "8305a00298d02758e3b848c7ee57086f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08b1542-4d6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694083595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083595, "uuid": "294acaf4-cc55-45b7-a08b-4b186d2e05cf", "comment": "Malware payload (Amadey)", "value": "293516aa1ce44d1c3ca0c6d23a5f198f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083595, "uuid": "bcffa617-8a0e-4891-b20a-4b77059ec352", "comment": "Malware payload (Amadey)", "value": "5c180d5019741dd8d31f2bdb7b0f3ec054f55af3df4c220f97ec49089acc7b98", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083595, "uuid": "c61d891c-56fd-4d4a-bd1c-d1b60bd15630", "comment": "Malware payload (Amadey)", "value": "353b5538108406d68e021d819a147fd1b21b3f2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083595, "uuid": "90d54afd-4915-4ea6-a3ac-398fa18fbc73", "comment": "Malware payload (Amadey)", "value": "e823618cd12d982e60cb21f5e0e80b38eb044d96e8ecdfef96d55513a99d361c8f36f49dac15e7dd253532566c9b709c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083595, "uuid": "52bb04c4-4729-44f2-a16b-c699fbaa223c", "value": "T1C824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083595, "uuid": "9adb3f1e-949a-4ff0-a86c-9709366ff741", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083595, "uuid": "b92cedc6-ff63-435a-9f6d-277d9c924b1c", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083595, "uuid": "b75e3d12-a5db-4e77-8e04-6f163d019458", "value": 226059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083595, "uuid": "8192041c-1657-4814-9430-57a0a9d47488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083595, "uuid": "e0de1589-6a95-47d9-934d-ad76c8e4dea8", "value": "293516aa1ce44d1c3ca0c6d23a5f198f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30fc92d-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694103302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103302, "uuid": "c726d018-cccd-4309-b2a7-f80ef7741f80", "comment": "Malware payload (NetSupport)", "value": "6cd3999044cc8c9ca5957c4ca83bb398", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103302, "uuid": "25ce62c1-fcb0-44a1-917a-834c74cfee48", "comment": "Malware payload (NetSupport)", "value": "5c8d532a1142f0396b6c4742b9762dca824a448afa857f8da08c51129187c829", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103302, "uuid": "2422a672-f6f9-44f3-bed1-db4176f9f18d", "comment": "Malware payload (NetSupport)", "value": "6d78a27d95300017e76622c92cceb3d260525082", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103302, "uuid": "f4b3790d-5347-4054-9977-f3c81329173c", "comment": "Malware payload (NetSupport)", "value": "ce3ec2a76b7ef2a7e7eb4c512695318bf629e85c4370cc2b23b0ad7197a9f7d48e2970bc9b072b7040df64edaa2725be", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103302, "uuid": "24f563a2-59ff-4472-ae69-e16585f6ab09", "value": "T157C640E85B80DC076A8C1D43BF55BFE94172A6639BEC72C782287BCC05E91D385A5CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103302, "uuid": "3d0ba8d2-99ac-4692-85ba-3f5b1478f9b2", "value": "24576:btzcvlXnwGoD3AQM53F+l8aT4W9aeUP916gGuFeK3mePXGv9kS9Y2tDEbOBGIGxm:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103302, "uuid": "9ab0e914-0dfd-4e5f-8665-cb1d93e32f05", "value": 12126529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103302, "uuid": "9a3be028-acc7-4c5c-a153-29b43c5ff305", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103302, "uuid": "64e1cbbe-5dfc-4ea1-80f6-2a61345961e0", "value": "DHL_____TBAR9300026763.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e0d5e2-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694075416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075416, "uuid": "4eabc298-6b01-41b9-8024-3c8f0a0a3281", "comment": "Malware payload", "value": "fc713bae269e79dbbe8185e4a29398bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075416, "uuid": "31600c88-5fd1-474b-af95-331b0a999fe1", "comment": "Malware payload", "value": "5ca151c69317137a321c909fd075091f575b71f170413aa474228ba5a60fe6cd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075416, "uuid": "888f1919-a05a-4bc2-859f-24e31c9cea59", "comment": "Malware payload", "value": "b27335fc13bee76810757eaabb13c1b839c86257", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075416, "uuid": "d4b014e2-fa27-4547-a88e-11263c803d5b", "comment": "Malware payload", "value": "290beee93be8e271bd011d2dceb4b5ab8e25578aca9aac752dfb3dbce7e96fdf80ac9e321ca313a4de281fc620f28fef", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075416, "uuid": "12c032a7-e050-41cc-85b5-3e1f20370c94", "value": "T1D6A3F155775619C2C8D614711F8B8B3338F2FD7A8AF0878908CAF6195CB72527E870AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075416, "uuid": "45c43b0b-a804-4c42-b7e1-b345b7ee265f", "value": "5efd333698985e0c33bc01c25c971347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075416, "uuid": "db166b06-91c2-4e7b-aa4e-54453fa8f6ad", "value": "1536:sRzdezMTHOFP5WKcyRm1YGl/KVzFeS6Bqt/pr2sQOIk+VI7R3OEluS1TdXu/Fmt6:xzMDKwKx8Yl1FKqtRFY8eElDToFmc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075416, "uuid": "a24e2202-821c-41ea-aa75-d4b316f76a08", "value": 102448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075416, "uuid": "e6ee1290-405f-4d98-bfb3-ae25e9ff41d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075416, "uuid": "99f950a8-e7b7-4679-b59e-5e7e12c27891", "value": "fc713bae269e79dbbe8185e4a29398bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7f54d8-4d5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694077068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077068, "uuid": "a4a2e927-f790-493c-b42d-ee98e364a790", "comment": "Malware payload", "value": "3e8c26a38f95046e1b28401aa9a2a8fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077068, "uuid": "78256b7a-ecee-4427-9894-962163d80599", "comment": "Malware payload", "value": "5cc520170f744fa5a071b3dcccd28d080a26fea6ffcf516c17d803ef2505a912", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077068, "uuid": "cdecda7b-0b36-43e4-bece-1a15376ceac9", "comment": "Malware payload", "value": "de64ba959a7d63044d051ec334e45f0820a7ffe4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077068, "uuid": "c665d88a-12ba-449e-be1b-981dcfa499b8", "comment": "Malware payload", "value": "75550031aedabfb43d14372c47e637cfb543e2e7902d68463d5ffc589a47806e27867634a2112712984744922c0a1406", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077068, "uuid": "3210813a-0378-4c18-a504-2d04232542b8", "value": "T124A523EE235C9653E85855B9E87BF398872D2000CADADC625E0868E65F677E004C7F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077068, "uuid": "4fdb212d-9076-4352-9ea7-ed1f68890bb7", "value": "b607646b19d96c496c6b6a98fd0002c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077068, "uuid": "347cdaed-0617-4939-894c-0ba2b44fc4a3", "value": "49152:U7YOOL8yvqTubQLxem/bmHFhXpit5OoDOMLT5H6lUfO2bI2GmoO+E:+YO+vqTuboemCfX43OoR35HlfzkkoO+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077068, "uuid": "0f319c76-ba0a-4328-8ef1-e6d48c57e057", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077068, "uuid": "6b040667-eb8b-4c99-ba16-ce6efc212651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077068, "uuid": "427b3e1f-1ba3-4873-bcb3-51110acdb4f4", "value": "3e8c26a38f95046e1b28401aa9a2a8fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b465b7-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694090126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090126, "uuid": "e58a4388-34ab-46b2-9e39-b308e48b75de", "comment": "Malware payload (AveMariaRAT)", "value": "9af374dc546fd477c8affd3d0294a8ad", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090126, "uuid": "ef3572c1-0f6e-4fd1-9b13-3a297ee89ae3", "comment": "Malware payload (AveMariaRAT)", "value": "5ccbfc6564f960202e0e34a71d067f4808fc644151323961b0300766f495996b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090126, "uuid": "b0e2c1b8-de5f-4337-a358-5cbf388de914", "comment": "Malware payload (AveMariaRAT)", "value": "53a18874992caf898dc291bef4d5a9937e6a4bd8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090126, "uuid": "d753b0a2-7f24-4584-bbc5-3cfeca349f00", "comment": "Malware payload (AveMariaRAT)", "value": "00210e9a2ea44929c6381cd17c333018f3a14c7e6989c252563404f50dbd29265635a9ce9567b7e40d14cc4aa1010205", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090126, "uuid": "0e289a1e-b80f-418c-9f0b-c7c2cfecd397", "value": "T16E356E15B2789875E05979B2C804E7D2B8AB3ED0A94F4CCD91AE7AF61873BD1390C05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090126, "uuid": "9ac45204-2b27-4c10-bda3-384807a4ac71", "value": "ad2271d934650237c138775ff423f68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090126, "uuid": "aa1b49d4-4577-4c13-b1d3-6df83fc1973c", "value": "24576:aMf7L4HFRk6LgYTYkOZ8qJ0sJYGi1t2WnVwho:a52k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090126, "uuid": "22a6bae0-4369-432c-a4d9-04c2a5819368", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090126, "uuid": "0edfef96-13b2-4716-aa7b-e12d9a2e93fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090126, "uuid": "dd3508ff-a7b8-409b-b7bf-5b1c4b6a0bef", "value": "Purchase Order 3884.pdf.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ad32e1-4d78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694088952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088952, "uuid": "5f8c8853-7069-4ebf-8146-e68d05f1a008", "comment": "Malware payload (GuLoader)", "value": "d10a8b79dc76dc194ae0f7ebcfd51712", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088952, "uuid": "138326bc-d68e-4a21-a32d-a154b286c523", "comment": "Malware payload (GuLoader)", "value": "5cfbcc4c6831a3196c9fd304d3164a8b59494ecdb9bae247ce68f6531add0dcd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088952, "uuid": "7c971618-6dce-469d-a27c-11e51e106cb4", "comment": "Malware payload (GuLoader)", "value": "4f2be3bcdfe3f41992884edd9b3f40ceb8857fb3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088952, "uuid": "44e5dc1d-54d3-43cd-8fd1-0d0da00e5aff", "comment": "Malware payload (GuLoader)", "value": "3f30eceabbf20672c2bf6d30e659c11a9136175cc1faeee90022fcc939233d4ed37721091a778ab071e0af2ed060a0e4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088952, "uuid": "be5d5dca-74ae-4736-b984-e5eed81056d1", "value": "T147551A91F968D9A6E57B46B2BC2F68B114868E7EE65400ED157E33081CB2316E0DFC1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088952, "uuid": "f0a3e6ba-23ff-4883-995d-957a8238a745", "value": "12288:AYCP66ke/hSPI7Rjd+UpQNm0qFxPjydYlk6Cvw:AYCP66ke/hSP0h+pNbqboLvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694088952, "uuid": "27ac4b46-85f7-4766-a9f5-227beca083c5", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694088952, "uuid": "77adc4dd-7629-4e84-9fe3-2b150f21cd62", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088952, "uuid": "aa29a187-eaac-4b9b-8b43-16d12f29e337", "value": "ORDINE_N.202309028.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b75560-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102723, "uuid": "e7e04bdd-7766-4983-89f8-cc88d6f29bb6", "comment": "Malware payload (Mirai)", "value": "6d980487c741406a2a4c457e36083536", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102723, "uuid": "a029ba12-8c84-4906-87c5-b1a5cf80acf1", "comment": "Malware payload (Mirai)", "value": "5d9174f4aa9ef7f65524680bb1e806784fc858ed576617a15abb2059d8efdcdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102723, "uuid": "f854bee3-72bf-4725-b287-a7101a97d055", "comment": "Malware payload (Mirai)", "value": "60e9028680e4efee41954c43387677a3dd143250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102723, "uuid": "648683dc-c427-4625-8c28-450c87e06f82", "comment": "Malware payload (Mirai)", "value": "64db67cd59ec1ebdb4883dc3d27ebf5f9af0fb9ec5b281a23cf40b0f78cbfa112d54edc518af7e2925859532f0c5d61f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102723, "uuid": "903f39be-41f8-4014-a4d8-c335686085fe", "value": "T126538D75D11DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102723, "uuid": "4bbd4158-5a8a-441b-96a6-482d0ce3daa7", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102723, "uuid": "f259c834-d7b1-461d-b722-0c1d8199dead", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102723, "uuid": "3c1e52d8-b768-45b5-959e-34077d861153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102723, "uuid": "c0ddb9a3-3fb4-4e53-92fe-5c012c1f53f5", "value": "6d980487c741406a2a4c457e36083536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa1507-4dc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694123418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123418, "uuid": "b38cbc44-7f77-48c1-8d5a-09380bf11ac9", "comment": "Malware payload", "value": "eabe47ce91e8b94a4d2aa447e28289c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123418, "uuid": "7c362a7d-6d89-411f-955c-96b25917986e", "comment": "Malware payload", "value": "5ddf3676cfc708cf03989e174d4697c3a3247547b01a110df141ef72dece20e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123418, "uuid": "23a6fdd2-2ef3-4a60-bdee-fbe1c5c4a530", "comment": "Malware payload", "value": "486e76d85caf440809273551a700824ea1f6405d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123418, "uuid": "975a8581-5b86-44d6-ad14-2c6416e45ea1", "comment": "Malware payload", "value": "95faa5ec506dc399cdf455c35164e54c1daf5eaf0a6e65391c99947756a25dc39a917024f65f96f176340c32c94a7325", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123418, "uuid": "37980ee1-4d14-46d2-b303-df830b17ee70", "value": "T1D34308817881A626C7D05377FA5F018D33199798E0EE33578C296FA07B8AD1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123418, "uuid": "d72d56db-39e8-4a43-9018-ed744e15d871", "value": "768:30ESWRYSaG0wBXAy9abThYrB2dPsnjVB5uEBwLRLWmPrqbh/8qkJSULwCVy/rCxc:dSaP0waejVEWYW0J8fhWfM5t0d7oHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694123418, "uuid": "b18ba6d7-c140-41e2-807e-9090e6ebf3ec", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694123418, "uuid": "ef8784b5-7172-4ba2-aa28-8d08f6ad1393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123418, "uuid": "65820d64-3f0b-465c-a4d3-4181f1a9b1e0", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c525f6-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694090017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090017, "uuid": "515bb188-d8ea-42c4-802f-0b5f690c17ec", "comment": "Malware payload (CoinMiner)", "value": "958df50cc4e517a323d87293e56d020f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090017, "uuid": "a969e1ef-627d-4252-99cf-79fa93548638", "comment": "Malware payload (CoinMiner)", "value": "5de1ef0ef1de122354aff82374dbb8d9ec61d472dc7836a9dd3b4ad1c0da5993", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090017, "uuid": "5349f706-8c8e-411d-aa48-c144d0d4d62d", "comment": "Malware payload (CoinMiner)", "value": "d6e848e5e818901afdaa94451c8e235172a04252", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090017, "uuid": "0be96371-1a44-4282-be5e-5d5705b5d8d7", "comment": "Malware payload (CoinMiner)", "value": "ffb9266892df3a465d6ddb5d718a86eb89e7a443839b8e2b883a400f160ca1038af803f1932916086665f6de80dcb62c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090017, "uuid": "98ad5c05-554a-431e-a899-e9a545259576", "value": "T17B954A4BBC9104B9C5AAD23188669252BB307C990F3163D73B90B7F82F72BD46E75364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090017, "uuid": "08fe7937-a3d5-45ea-a775-25715dab5f84", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090017, "uuid": "a156a2a4-6b89-48a6-b1c4-3907aa3a4e0b", "value": "49152:y3Z8b5JKGBrb/TDvO90d7HjmAFd4A64nsfJOC6qYgyypqlzqR23D1:9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090017, "uuid": "552e79d9-96e8-455c-b88e-0d5d1c43d422", "value": 1886720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090017, "uuid": "abf80355-27e8-4420-8b30-7a9a18c1a56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090017, "uuid": "610b0018-335d-4a1f-b2d8-e75e1488ca19", "value": "5de1ef0ef1de122354aff82374dbb8d9ec61d472dc7836a9dd3b4ad1c0da5993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d32978-4d6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694083976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083976, "uuid": "c051fb35-40f9-47c2-ad4d-87770a0e8601", "comment": "Malware payload (AgentTesla)", "value": "637577ed005cabead8c02b0714110b88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083976, "uuid": "24036b3c-0fe3-43a0-a68a-7a9358cd69aa", "comment": "Malware payload (AgentTesla)", "value": "5e1d953a310fff548296b75e81092f5f360c146f02c45627fed82a8e85e8582a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083976, "uuid": "dbf1d57c-18a0-4fa1-9611-d9c1535d9d11", "comment": "Malware payload (AgentTesla)", "value": "e4b018e9963568a051af286c578082e8c8662adc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083976, "uuid": "a101c2f6-faf2-4eed-b506-3a29e8fcf001", "comment": "Malware payload (AgentTesla)", "value": "119bc12f66de0520b394dbe53a45693e3a3be540f9f9c7e8e8f1839d5322d2926f73744f52f727c5f626fa4c98e3816a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083976, "uuid": "d713b809-b4e0-456d-947d-367f53c2bf1c", "value": "T1AC157BC9E275C7C3E03917B5A4692A040F702EB974A5D3D06DA235DB79F0B812A6363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083976, "uuid": "a7ac7a60-52ca-4f7a-b2ec-3a50a3318559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083976, "uuid": "85a581dd-79b8-4999-8479-cb32c8fd6106", "value": "12288:5TjK2d1mbTdaLytfIoxeqAosnl5DNoJjQi2BVSkat5kCz0IzAvrTQftit:5TydACfIox+oY1NMdOSB5kCGvrTQf8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083976, "uuid": "581d6edf-a0a5-4590-877f-c071faa271b2", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083976, "uuid": "56fda5ad-cded-4793-8628-79e8af7cc322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083976, "uuid": "66804d0e-16f1-4f3c-ac02-1f86f410b4ac", "value": "5e1d953a310fff548296b75e81092f5f360c146f02c45627fed82a8e85e8582a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf6a9ec-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103048, "uuid": "5e1d63cf-bf36-4490-87dd-27e20503b330", "comment": "Malware payload (Mirai)", "value": "aa90d913e7389bdf6d2c6a3315e91606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103048, "uuid": "5185e109-0813-4bcd-b444-253db20d89a5", "comment": "Malware payload (Mirai)", "value": "5e1fa2bd34b5f91627ae520e8abafec9ff34a0d0649a4b7f5e568e253503a056", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103048, "uuid": "4466964c-87b4-44f9-b3d5-19bedba5bb4e", "comment": "Malware payload (Mirai)", "value": "611774172b371fca95920a160d61090c7faf5695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103048, "uuid": "438c9df9-58bf-4a36-b7ec-28f58c5e6824", "comment": "Malware payload (Mirai)", "value": "eafcb4924487cd736ac213d57110c807fa38733c254cb59d1a48a9ff9f6070b239c316efb580cf1cb8f5893748d84837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103048, "uuid": "54fe8feb-1c3c-4c71-8dd6-866d5384a497", "value": "T1ECB2D2A48B95A707C2B0B436A3788F925B3715D4C5F53937261092BCD54349633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103048, "uuid": "ec43b93b-75a1-4ec0-8b49-448d22cc8259", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+ByBWQ/hymdGUop5hu7X:4GHKQFH0rs3zWoDDRsjt7LB9U+Bgs3UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103048, "uuid": "45f4bc82-1f16-46eb-9ecf-b62ae882dd4c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103048, "uuid": "3a46f59d-db91-4445-90f6-b01de08eb13c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103048, "uuid": "f3bddaec-5c94-49e7-be84-4a9686d4f3c0", "value": "aa90d913e7389bdf6d2c6a3315e91606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3a6e18-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075244, "uuid": "f21ec145-6eff-45da-bef9-b283511695a4", "comment": "Malware payload (ConnectWise)", "value": "2c446b4163f52ce1266769a9c3844f1f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075244, "uuid": "a8bcfd60-bc77-4a1d-a8fb-1f38b93edb47", "comment": "Malware payload (ConnectWise)", "value": "5efb1a07feb64993d6b90b4e70b219ee455c0973b84aaf56a04821066b6421b9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075244, "uuid": "87f7e0d2-1e0c-4073-b706-09cef19f0763", "comment": "Malware payload (ConnectWise)", "value": "2802a13e418385aadce770e2cde218162dc83695", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075244, "uuid": "d5b00856-4caf-494c-a453-114d56c70b7f", "comment": "Malware payload (ConnectWise)", "value": "50f6738a9524c3706c638c928a749c8d54a2536c8ce004b152643e787b48aeeb3df7a8546f487a75558b9a3871c508e0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075244, "uuid": "92237c1b-8511-4fe6-bd88-de6fe641c0d4", "value": "T189E5122237F98539F2F71B35ED3A91B05D3ABC249E21C11E5364790D1E72A808AB6773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075244, "uuid": "378fc823-6b68-4f4c-889d-16eea81aa734", "value": "49152:ItzP/DQtSwBLlw6f4H7GxIcrq6x4dYdJSnG6Kk2f2gZgBZgQfpN31gb:s3nWn4bGbq6adYdsnGLPygQfpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075244, "uuid": "46aa6495-6f51-46b0-a439-cbb6b3486d96", "value": 3059712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075244, "uuid": "51cdf028-b60f-48c7-be70-a7d02b11fbd5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075244, "uuid": "df110763-4944-476b-8856-be5d0f70032e", "value": "2c446b4163f52ce1266769a9c3844f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda88e05-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694096045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096045, "uuid": "0e164625-2210-4a01-b1ea-460313820744", "comment": "Malware payload (AsyncRAT)", "value": "2ff74ef17b318fd8987f4e9ff88aeaa0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096045, "uuid": "73b7ab22-9d5f-4a49-b577-7875327fecfb", "comment": "Malware payload (AsyncRAT)", "value": "5f134bb1a56316bc3ab22c1a22daa38335b93569fdb327a4e252c7dd6594d494", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096045, "uuid": "2c98e5bb-3410-401c-9a19-5d86d4bbf3a6", "comment": "Malware payload (AsyncRAT)", "value": "25432942602e4d8ef5653db6a27a4fed394995fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096045, "uuid": "3f784c2d-bab9-424c-9830-a6308283ecd7", "comment": "Malware payload (AsyncRAT)", "value": "4329463256cd87333aef8897daae8047cfc5704026ec01a8256c6c16f338885601090e0405ada47fb3dd6e19591cc8d7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096045, "uuid": "0664405c-ae78-4ee7-802e-ba1a469bc09f", "value": "T1D453E8013BF98029F3BE8F7469F6618546F9F5AB2D12C54D0CC954CE0632B829A41FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096045, "uuid": "aaeb7f76-fea7-46c3-b966-2a58c666d270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096045, "uuid": "7da2bb21-40af-4a5a-9f1e-6b4aa921ed5f", "value": "1536:3mImJ6tX2kNff4sKu+UYFDGXw5bfAP7pJhx1+rPlTGZx:3m9J6tmkN7Ku+UYFDGXw5bfMpJ1+dix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096045, "uuid": "76914f3a-6459-41cf-a778-ec5a9c4ae276", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096045, "uuid": "b5274948-9caa-443e-b691-994d1494fabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096045, "uuid": "80a0044f-8555-40c3-a43c-52603cb12116", "value": "decode_d8a9e3c567ec108d8673506487477f4bf1cf3e43a11c1c7b11dd808e7d90229d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2943886b-4da7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694109084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109084, "uuid": "ef008225-3bb4-4ddc-b132-da4e60f1a5e3", "comment": "Malware payload (AgentTesla)", "value": "09fb50ff005274d1a25b7bb9604f7d82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109084, "uuid": "c31ad518-2195-4c9b-bd3b-c2fd865da2f1", "comment": "Malware payload (AgentTesla)", "value": "5f348fe41915ae5089634894d32316469efc21b5cc6e85a0f100aa70cd2f3474", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109084, "uuid": "8e69f362-9ff2-41f6-9624-d10338cf7171", "comment": "Malware payload (AgentTesla)", "value": "2b7964504bf9fa998a91342f5e4811ae9ae1caeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109084, "uuid": "d841d389-c7cc-4dae-83af-a170a9e77311", "comment": "Malware payload (AgentTesla)", "value": "85005d358972e2d026c365a54c6c9f71bde9323162447036ddb766571afc2c1805540ea5e6ef829350dc3657130cf106", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109084, "uuid": "46063417-adc8-466a-af91-2f72210086fa", "value": "T117E4EFF850A2C3E2D7B4A3FF509B98759A237C52647586DE73BC7A440EE5B870821C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109084, "uuid": "06f820b3-b009-4217-9ccc-59a2fda48761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109084, "uuid": "168598cb-eca0-4fa5-b13f-e63bc52bff2d", "value": "12288:Z5fVsbR2cm5meORZV9ga0bfssWAE8T4B5w/zSr32UkE2nE8SE:ZtO27rOR0bUsvB4B52+KUkHEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109084, "uuid": "b1bf1038-17e9-4382-8d27-e4a57c8b4baa", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109084, "uuid": "2e9a05dd-b3fb-4235-bfbd-35f819fd926c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109084, "uuid": "fc04ef35-f14b-45ac-af67-77a0c55b1180", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191758b0-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111634, "uuid": "499eb123-95bd-4c5e-8b76-f4becd7af8bf", "comment": "Malware payload (BumbleBee)", "value": "3b955958829c8ea45e2de001bbd7da4a", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111634, "uuid": "a67bf4d9-f519-47c6-a49f-47ea3ef78263", "comment": "Malware payload (BumbleBee)", "value": "5f78e94c7eabe39a9c6297db3f12ef5161d835c7c65928d990ea98c0528e04ef", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111634, "uuid": "1f2a4b4e-e7d9-4805-80b4-8c720e7e8d50", "comment": "Malware payload (BumbleBee)", "value": "6b0fef8a7422608fa97d7d971774c469b24b9cfa", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111634, "uuid": "f1b44880-6d39-4239-bc62-a9a54dc76399", "comment": "Malware payload (BumbleBee)", "value": "e45109554644e5944b6e78e32b29ca2f74b84df2426e66a4e8424b9cc87a116bc385947fa8b4666b4b4b6fb75402ff47", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111634, "uuid": "9b627863-20ba-4497-a9f6-9a2ce301a600", "value": "T1E8D4C08FE9E5BBFEC42D41B7C88F02A95163A6806E06096F696D025831E3B4373D775C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111634, "uuid": "79646736-0d37-4e41-8765-59af652112a6", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111634, "uuid": "fa29d9b4-0791-48ed-bfad-acfa198a11dc", "value": "12288:1oDaxTrSQ8rVdKEC6k5DTSQfSsj9I6WiT2cn2qDq43MIFmL:uD8rSbBdV2V5j9V8c2qDM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111634, "uuid": "213ab56f-1936-4066-81e8-0eb0daffeb7e", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111634, "uuid": "07965826-55ca-4e4d-ac2f-17bc8b460e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111634, "uuid": "31c76481-94af-40f8-8aed-ee363df65fc4", "value": "6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a891eda0-4d68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694082239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082239, "uuid": "156140e2-9e58-435b-88f8-f2834b448f5d", "comment": "Malware payload (MysticStealer)", "value": "79aeea7e2cae474eba241c822e5f99e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082239, "uuid": "c7461965-d33d-4a35-8009-f2ab1bc5e07b", "comment": "Malware payload (MysticStealer)", "value": "5fa9d9b71791483ca380f09e1fc946b0ba7d68cfb73147bf80aa472b72497ef3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082239, "uuid": "8528328f-9bbf-44eb-b0cf-ce053c050911", "comment": "Malware payload (MysticStealer)", "value": "ba65a66fafb5479876fede8172fba0fde2593e5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082239, "uuid": "a2e2308c-1b7f-4b01-9ee5-76f35f1e9190", "comment": "Malware payload (MysticStealer)", "value": "76c111411ca0eb767e6d2a86418208aac5d38f15f37f4e78f0f127561a3c38e102bbea373a5a0c10fe04b5b2e2a54498", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082239, "uuid": "1d47d10d-af77-475e-a3e2-314a545c4e46", "value": "T1A644BE6AB9C0C471D9A2A47109249BD0697CFC305F233AB733C45EF629951C2DEA58EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082239, "uuid": "cb1d5c34-9b1c-42ef-b3de-0c7a4c4440eb", "value": "caa8d22a27bdeecfeb10143eed185335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082239, "uuid": "9d56dc3c-faa6-4ad2-ba8e-40578f44a2e7", "value": "6144:BypnplhoSByJCTT8rxblMDcUWO7jD4wcGB:ByppboSByqAlliPD1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082239, "uuid": "6565cfa5-c715-411e-8082-bcba4fbb6e69", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082239, "uuid": "3b96ce0f-1f59-41f6-9aec-a58997ee6c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082239, "uuid": "53c616ae-56e4-4467-8525-fec6583f3654", "value": "79aeea7e2cae474eba241c822e5f99e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eb47f0-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694090576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090576, "uuid": "6ee2b59a-1156-4973-86e7-e7dcc3cda851", "comment": "Malware payload (AsyncRAT)", "value": "0ce63d48fb37d73670d6ab8c2607caaf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090576, "uuid": "eb1a5fb5-1279-48f2-9d7f-5adde48d5c7a", "comment": "Malware payload (AsyncRAT)", "value": "5ffe30a38ba34b6f1ba296571c6f9cbaab3e8f5033e84a2cfd36e8049238de51", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090576, "uuid": "f233780e-9b2b-4ce4-833d-fae32ea88c66", "comment": "Malware payload (AsyncRAT)", "value": "b02520d40eebf849126e899d20d60b63f365fb05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090576, "uuid": "0407bd68-f13f-430e-9e93-1cca1bee714e", "comment": "Malware payload (AsyncRAT)", "value": "1457acb34bee9fc9b2aa3e2fec9c6db94d437927aa78def210e8935049e7c41edd4e97bcab314d3c02888bc081bbf3ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090576, "uuid": "bf8c679a-da50-4be5-af78-7387b60dabd0", "value": "T17F231A003BE9813BF2BE5F78ADF26145867AF2633603D54E2C84119B5613FC696429FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090576, "uuid": "323119dc-8adb-4f6c-a773-b2a93b2df591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090576, "uuid": "b738a80d-d1ff-4c54-b5d3-9624ec51004e", "value": "768:Fu/6ZTgoiziWUUM9rmo2qrixT7Vx12AisPIIzjb+gX3ibwFbVLT1yaADa3Z3BDZL:Fu/6ZTgle2tiI3bBXSbwZJBaapxdie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090576, "uuid": "2fda83b9-34e1-4586-910f-a157c53a2446", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090576, "uuid": "7e092b6d-a3ad-4ce4-810c-f81709439457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090576, "uuid": "e42a01f1-48fb-417b-be46-4424e77de915", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5ddbd8-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084639, "uuid": "d1c86a38-09f8-4f1e-8005-be7f5cb59f21", "comment": "Malware payload", "value": "0b3410c95700c08e3f0323403fbca141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084639, "uuid": "46f2d49a-df88-4b85-8c1f-1c9abcc771e6", "comment": "Malware payload", "value": "604524d37ba633b2845022da62d08cd1c3d3cd348c995147a170f7a320572ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084639, "uuid": "d9891f34-3298-49b8-8b0b-ae5f57447b10", "comment": "Malware payload", "value": "c73d3e8baee77dc7f74a40fa878e7db183ae9bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084639, "uuid": "30874bfb-8703-435f-a956-d1d9a05a7dcd", "comment": "Malware payload", "value": "b9345f10bf7091358af6889adaa88c1ec20460a8fd18c6879f7a727032cf252679a41f7c1c05c667c3c96aef18ed586f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084639, "uuid": "411c32e6-3bb0-4228-937f-4a492dd5079c", "value": "T10E94025FB74523B2C28102362A5E49DBB72D547913BB82E7186DC04D2362EFC52BBBD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084639, "uuid": "f6385872-9474-4230-b9b8-6d66570b6aad", "value": "3ca3c892345603e17441ddac6a1d0f23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084639, "uuid": "1c5af09d-e65c-4f7c-82aa-5247443a7ac7", "value": "6144:JGZctBeEMnmkitJ7BLRm2fiA4aepmed9O5I4QSreneWjO1Lxee0feRvuCET8sO/G:JGnm1tJe2fida2YQSrKeiOefehIoRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084639, "uuid": "b73e59f1-6109-49da-896d-bba91e90c974", "value": 434901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084639, "uuid": "3ce718b8-b2d5-40de-8984-f516f5a5c6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084639, "uuid": "73b39109-6265-466b-a6f3-0ded8651da5c", "value": "Trojan.Autorun.ATA_virussign.com_0b3410c95700c08e3f0323403fbca141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8e6c73-4dd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694130755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130755, "uuid": "2cc0dddd-0d52-4139-85ad-cd0282e8afcd", "comment": "Malware payload (RedLineStealer)", "value": "2cb68f55b3989dcea9326bd8e68866db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130755, "uuid": "485b2629-d092-4836-8d3e-27fddad53672", "comment": "Malware payload (RedLineStealer)", "value": "60789c12b18ac6e7b8efaded764cf36f146dc017d38ab76974e7f2f2c83f6cf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130755, "uuid": "e1c427e1-a581-4957-a445-00a39f048850", "comment": "Malware payload (RedLineStealer)", "value": "835580ac6a5ca0d3d1d36ac8a0a278750ecc09eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130755, "uuid": "4012d398-d2f2-4330-87d5-1f18eadef00e", "comment": "Malware payload (RedLineStealer)", "value": "6ba902c6bf9b031093b90c8641c87b037aded1e0718a4b64eb551cbf9fc13371fa1215dea0666146a12f6b66945fdaf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130755, "uuid": "b7d7539e-f7e3-47e4-aac4-ba165f85c652", "value": "T110F3AD11F5C0C472D9B229320960EBB14E7DF8341F60AE9B639C36796F243D29935EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130755, "uuid": "9cbe7d7a-5467-46e2-bb3d-3dd5945596cb", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130755, "uuid": "01d28156-dc21-4a82-bdb4-766a332b5c8a", "value": "3072:7fc5v6HW5HdQsbI6/d1kCPMlzhk2Ww+19Zu3cgA81jIl0oLmpRURSQZc:786HW59nd1kCh2Eon/7pBQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130755, "uuid": "c19c61b6-2bc5-4611-8321-7ef3d4d6b3e0", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130755, "uuid": "ce795e29-f988-46bc-88de-af55d4e163ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130755, "uuid": "066e083a-f423-42e4-ab25-23f3b4bf69e5", "value": "2cb68f55b3989dcea9326bd8e68866db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf73ef38-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694096021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096021, "uuid": "5ee4400a-7e65-4840-8c4c-ddd50c0c231f", "comment": "Malware payload (RemcosRAT)", "value": "622cf413f87d83fedf25ddabfb271c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096021, "uuid": "09a06f5d-c402-4f2d-bfcf-2c6bc44748b6", "comment": "Malware payload (RemcosRAT)", "value": "60e520cabd741f718ca4b748b8af4e793c637de473cfb5091281660827b59ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096021, "uuid": "a848bcc7-1b7a-441b-9eb1-38a0348a3024", "comment": "Malware payload (RemcosRAT)", "value": "044d965c68ff785c775baa22a85e4acd210a1f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096021, "uuid": "310f26da-a214-4149-94bc-ebe9b6fcda0f", "comment": "Malware payload (RemcosRAT)", "value": "062972518331f57d02c6d89b89495e20f11630196751f67c19aadc4e04df9b643b06fa85a9a8028225bc5945b6fe3bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096021, "uuid": "50a34b04-6aa9-40a4-94ba-f2eda5698176", "value": "T147A4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096021, "uuid": "c8bce1bf-56ec-4331-95d0-ca69a547a33b", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096021, "uuid": "5ed6b9be-c33b-46ff-900d-e9ac41dfb46b", "value": "12288:dRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2LDU:dx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096021, "uuid": "68d60daf-1e05-421a-814b-fac342bd5fa4", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096021, "uuid": "ff49cda8-852f-4bba-bbd0-4b1f21a154a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096021, "uuid": "235e3ef6-38ee-40c7-83c2-019ec249cece", "value": "decode_35afa7fb51c6a44da02afbd433409f8ebb079bb3753bc42b22bc7b558248248f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0625a4-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079695, "uuid": "522a6d0a-b3a4-482b-81f1-6697229782b4", "comment": "Malware payload (Mirai)", "value": "7c2c3933c7e5eb6dee40202b0e6fc687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079695, "uuid": "c6f00e90-348b-417c-838d-798cae757fff", "comment": "Malware payload (Mirai)", "value": "61d2dfda288cdcb04a0c913a47f2b664b0a18b72cbc8067a2b5efd65bff779b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079695, "uuid": "4323af19-481a-40d4-aefa-6ffa091bb25e", "comment": "Malware payload (Mirai)", "value": "0424a3a063f2506a51909965166d794370f64a55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079695, "uuid": "e40d7812-32f6-4fb0-b91a-38aeb097c66a", "comment": "Malware payload (Mirai)", "value": "8d046a4863afa1029015ba6ec9e2cab6f521addbcfc0e711d529f974fe09839afa2b9bd7635dd4a23e673f5b9de13d41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079695, "uuid": "26b8efde-2eab-46c6-ba2e-c0c97ab6f0e1", "value": "T1DFC2E084F0419E45EFE629F03D00CADABBA16F1FA966CE8076A093D16B5D2674309DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079695, "uuid": "a2caa339-989d-4145-89f5-d25611d4d981", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7Pl4uVcqgw09n:mam+AnKehPRa9a94u+qgw09n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079695, "uuid": "9f744d7d-7d64-4323-a36e-378291e3628c", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079695, "uuid": "ef09d063-6b74-4710-bfd9-9b211275137c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079695, "uuid": "5d295290-6c61-44ff-9928-f4228a3d2582", "value": "7c2c3933c7e5eb6dee40202b0e6fc687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ba9988-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052388, "uuid": "74fadd34-fd12-4bbe-9599-104a879bf821", "comment": "Malware payload (Amadey)", "value": "5f3592c387dbfde4ed60eb768412ef57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052388, "uuid": "6979d8fe-9a1c-4195-bbaa-04d3664ea7be", "comment": "Malware payload (Amadey)", "value": "61f039d8802f3a905882df66abca4cf34936601530c5a35603654a61ba3a6a86", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052388, "uuid": "a90d626f-2eec-4bdd-a929-ed094daeb7b5", "comment": "Malware payload (Amadey)", "value": "e79bd8e4911078b2b71eb19a6ff5f7ffc8598ca0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052388, "uuid": "8cd4df35-4d3b-4dcd-99f8-7b8094a5112c", "comment": "Malware payload (Amadey)", "value": "5d43a9754492863bf0d7ee76ef3376f41d1135e2f106d162dd60241a9654b9b6a8a5b25cda7e190b043c6ef1f739edf8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052388, "uuid": "06b701e2-bfa4-495b-a722-5d27cca51da4", "value": "T14A24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052388, "uuid": "7bfae426-348f-411b-ad8a-b526aa912bdd", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052388, "uuid": "01520c9c-d226-414e-889a-3d853dd831c7", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052388, "uuid": "fc33e56d-c9ee-48ad-9ef1-5c91067a772f", "value": 225593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052388, "uuid": "e771e522-8349-47e9-a8f8-5296c493405f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052388, "uuid": "9b270bd0-4f4e-4424-83f0-ece189a221de", "value": "5f3592c387dbfde4ed60eb768412ef57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dad9e1-4d94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694100978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100978, "uuid": "2419090d-2cbb-4ced-bced-1a081df92370", "comment": "Malware payload", "value": "dbcd3fedde96d6426a28595db4930781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100978, "uuid": "851510f3-f733-4b00-b01e-ca1c1519dfc6", "comment": "Malware payload", "value": "625bef9c38349fbd11a098056228437b796ca73e28d70b2410498b15610516b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100978, "uuid": "a9d240e7-029b-40d2-9cca-c9eca1706296", "comment": "Malware payload", "value": "e50f980b886874ef81358c652d5f8272b1f84c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100978, "uuid": "2c7918c4-8243-4d51-97ed-8bc8f90c891b", "comment": "Malware payload", "value": "41aed226c95fb5e2eaf38da47cf66d227de6f9872dd4ce1fffc34fdb279f1b7ab57e89aaa010817d091ed8d3d917c34e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100978, "uuid": "0b149440-4cf4-4edd-a341-3c6e30a164dd", "value": "T1F316187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100978, "uuid": "4010a39f-92f3-49cb-b981-0ef9c0fb8106", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100978, "uuid": "3774d3e4-4ce9-4974-afbd-47d1d7883893", "value": "49152:agh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWKjXNO:Qa71fmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694100978, "uuid": "d8b9d5af-4074-499e-9402-17b850222c3e", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694100978, "uuid": "b6c4eb18-d280-4381-87a6-0f26c30c79c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100978, "uuid": "084af491-1d88-4409-9170-fdda1c1cae0c", "value": "SecuriteInfo.com.Trojan.Packed2.45650.463.9001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338fed5f-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694096646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096646, "uuid": "9847fd74-7e92-4c06-b693-4aeabdc00026", "comment": "Malware payload (RedLineStealer)", "value": "fa8916aa20a5be8e28d0641572c2faa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096646, "uuid": "080ac596-a1d0-41e9-a6d8-f0bede0a4cd4", "comment": "Malware payload (RedLineStealer)", "value": "62ecea35a4840c0e54486e3ea0773420fa01eef25b0d961977dcc6f9637c4f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096646, "uuid": "283c25cd-c783-4dae-9afa-a167e391b304", "comment": "Malware payload (RedLineStealer)", "value": "0e3d6097734ffd9d16f4c3710dcdf276c4ba56cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096646, "uuid": "a8252b53-1f8b-4f82-ba0d-f15c7b11436e", "comment": "Malware payload (RedLineStealer)", "value": "bf8cac3032b3b796016169cb3d4bd8d97ffbfefe5c140e12b8514f7ec65350c86ac9a612049e061ffbf4775a19d793bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096646, "uuid": "420a2450-e74a-40fc-8b5d-acbed768f295", "value": "T19DF42212ABD9E1B1D8B42B7049F612530F78BD60197C93A73740694E2CB3B90B97673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096646, "uuid": "0457069f-0938-4bac-9e1d-d708b7bd8130", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096646, "uuid": "6bebd642-d6fc-49d8-89ce-010a5f2d8462", "value": "12288:aMrDy904yWBEjmFVnEa/w3DcqCRiYGvNm0aqoNTeLSdrWkKXtFjfp1wIz7a4:xyNRBRE+FRiYlqoBe2drWXbp1D+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096646, "uuid": "5cc8272d-359d-4b56-b738-f38ec1b79311", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096646, "uuid": "ffee5372-cdbd-45b8-ae87-017ab9abea3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096646, "uuid": "a84f5592-b85f-4753-b0bf-99e65b23ab81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807ac923-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694103647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103647, "uuid": "a520d8bf-7ea5-40bc-baca-514e52abeebe", "comment": "Malware payload (Smoke Loader)", "value": "d221c5ca032d0a6b7e2d6791c4805f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103647, "uuid": "e1bbd1f9-fdee-4d79-934f-d76a29abedce", "comment": "Malware payload (Smoke Loader)", "value": "62f0f64c7dfc3eee27326734d48b50dd15c668f8109390391f61fe888dd834dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103647, "uuid": "70a340f2-021a-49c5-8e84-7d1e3b28def3", "comment": "Malware payload (Smoke Loader)", "value": "7aa15d1a73221fb57f678daf1f09cc01a8042ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103647, "uuid": "3c2b4f52-1544-40fd-8de5-4e30eca2fadb", "comment": "Malware payload (Smoke Loader)", "value": "32a0e58a5942d4f37b9ac70df91b02b72cbf650057df45f62f3275cade2c42d0a9ce3a1c4dd1deddada694a37c5d422a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103647, "uuid": "dcf6ea32-0576-492f-aa5a-b89b847e63da", "value": "T194645C13B291B861E527C6318E6EC2E52A1EF9E14F55B6EF1355AAEF0C701E1CB72310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103647, "uuid": "1f04d3dc-02bd-4855-bbb3-c3e210b47129", "value": "e77054925f91bbb709fc17135ae0c093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103647, "uuid": "8afc958f-d8b8-41a4-aad7-e919387ab22c", "value": "6144:6hA5DUSazDoybOeBBIda231d17HY9VsxsAt:6ognnoy3BBIg23n17HuW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103647, "uuid": "9e618256-e2de-44c6-8df3-128424351718", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103647, "uuid": "914dc0e8-72de-4cf1-b018-234383f4fccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103647, "uuid": "a6fb8f90-7008-4f02-adef-36f8416d07e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86313d8-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694096036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096036, "uuid": "312097a4-3013-4faa-a096-88ada7c20619", "comment": "Malware payload (AsyncRAT)", "value": "d2d1c93a17d916239e6dcba856c606d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096036, "uuid": "786861be-e2f9-4583-bab8-27e1bb4b21f8", "comment": "Malware payload (AsyncRAT)", "value": "6325037ee8cd40f6d7757c8d259cc258f7e170fcf4f0a6f4832693f52eb50849", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096036, "uuid": "14cd93a8-c180-4677-983f-94367be6b9da", "comment": "Malware payload (AsyncRAT)", "value": "6bb5d33c262562640065ea26d45fc753a07a944c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096036, "uuid": "97aaf94c-7d6b-4101-a1c5-5440f8faac1b", "comment": "Malware payload (AsyncRAT)", "value": "27d341317a34cd4821d29887b54c8bedd854b87823a42642bef290535d7fc7fa69ec67d895c870e6fade38b73975e95c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096036, "uuid": "4253f889-bc22-4fee-9ab4-6ee8ed903183", "value": "T1F6236C4037A8C136F6FD8BB5ACF291458679D62B5903CB496CC810EA2B13BC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096036, "uuid": "4ab6168b-043f-4c48-939b-23a052fa4950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096036, "uuid": "37d51dcd-c988-4073-85cd-22abea6e732a", "value": "768:Eq+s3pUtDILNCCa+DiPy/9ooXsijHF8Yb7og/DDH0KW3djdvEgK/JDZVc6KN:Eq+AGtQOIooXrlzbbrb0KW3NdnkJDZVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096036, "uuid": "9b0d5bb6-806b-4b2f-acac-8d1a10477ec0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096036, "uuid": "a96cbe2e-b83f-40f2-8ad2-098284059368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096036, "uuid": "85eff389-dcb8-4537-b3c0-6ed18c8ebf79", "value": "decode_a410203ad23ba8ea9245c8cfab1cb41f8b19db61910abb0043de89954f13c898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e290e759-4d56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DynamicStealer)", "timestamp": 1694074605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074605, "uuid": "dbe7cf02-79c5-48eb-bdff-388b15a5619f", "comment": "Malware payload (DynamicStealer)", "value": "9be83826970ecc2715182a2c45f50c97", "object_relation": "md5", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074605, "uuid": "476773de-c7e2-4d69-89fe-154d9612680f", "comment": "Malware payload (DynamicStealer)", "value": "634b6c0a26e822e2c6ba3d9f667c6d41abb76ea8b171b8376907e5151a95b227", "object_relation": "sha256", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074605, "uuid": "289858d1-bc91-4bdc-aa3a-eb6a59b31d6d", "comment": "Malware payload (DynamicStealer)", "value": "4dcc029cbd208e0d1317bee928d21d04910d9af1", "object_relation": "sha1", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074605, "uuid": "51038f62-c730-4896-89be-546fb1baec8a", "comment": "Malware payload (DynamicStealer)", "value": "0a1a418899aa8018e12259b73931c352c328c4ef19c48e028c7fe68ba2cbbc6ac4920a5f2e1cb0bbd0de86ec4db8edf8", "object_relation": "sha3-384", "Tag": [ { "name": "DynamicStealer", "colour": "#DAD084", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074605, "uuid": "c2e05c1d-e627-46b7-99c7-a3637e858488", "value": "T18B7522F7FD844B3CDB633B790E0A9CA7998CADB6ACDAC047247329448414D0967DA7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074605, "uuid": "f65d59fe-7e24-462e-9538-429cb160a68a", "value": "24576:0OEGwsZomo0TARMHoO26EhYQcE+bEJe14ghVegMCQ6xKQU8hjRJZUt6p75rH/nOS:0dGj6RyoN6KFcLoI5ML6xKkJ1RVH/nRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694074605, "uuid": "6d43b71b-ef0d-40b8-bd25-8fefeaeb28b6", "value": 1621720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694074605, "uuid": "3381da1c-7e42-4e01-bf46-0f8fead08477", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074605, "uuid": "cedb2f71-d12f-4c8e-90e3-f09f8a52a4e5", "value": "Tax-documents_PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a744159e-4d26-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694053890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053890, "uuid": "b6126830-8635-4dc6-951e-b28b454ca4e4", "comment": "Malware payload (Amadey)", "value": "17d3f1c02b455941a61ff2a0500aaacd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053890, "uuid": "77af0580-6ed6-449d-9841-424f6ce7907c", "comment": "Malware payload (Amadey)", "value": "6361dd115bdf9fec90037054df91868b101eaf927e57d24c02ef5351d6efb006", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053890, "uuid": "0750775b-825e-47a1-9962-f4abeee9a483", "comment": "Malware payload (Amadey)", "value": "352ffafed7a01e5707ce3bcdba681bed0df1696c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053890, "uuid": "094b3c7a-e810-4233-a5c2-c8a9ef9a43f5", "comment": "Malware payload (Amadey)", "value": "19f8ea2aebb916e849428ed38c1438a5a78ba0da4a2b32fd808cf16206e784017a1b64bf2e0e5cac3491c902215dbcc1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053890, "uuid": "a1294db2-1650-4f3f-bce3-fd76e05540db", "value": "T12924F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053890, "uuid": "68ff4264-2835-4393-a954-494d643bb415", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053890, "uuid": "aa51e904-82da-459a-966c-ebbde8f40af0", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694053890, "uuid": "a3fe6d1a-71ff-4297-b2bf-70cd9c1a084f", "value": 225675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694053890, "uuid": "5c61040a-cc93-48a0-866f-4ecb1ff4d8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053890, "uuid": "4530e7e3-bb83-4a19-a2e0-42344b4025c2", "value": "17d3f1c02b455941a61ff2a0500aaacd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8c189e-4d78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694088957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088957, "uuid": "cdba6089-4c40-439a-8d38-8b92e085620f", "comment": "Malware payload (GuLoader)", "value": "2ca28e826f2bf37c50fd7037080c99b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088957, "uuid": "f3325470-14d9-447a-99ad-d8ae71cae276", "comment": "Malware payload (GuLoader)", "value": "6364c512939371a20d279dfb4c03f6e2f762edbc865eef9207e12f7983bb26c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088957, "uuid": "27ce639b-375f-434e-9081-41a736424c2d", "comment": "Malware payload (GuLoader)", "value": "4878d5026ee0a8a81177b9c9f7d50b7a426434cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088957, "uuid": "b8d1d23b-7fb6-4985-8e79-bc100511fe9d", "comment": "Malware payload (GuLoader)", "value": "4b857e3f51b8961082392b4ca790f376fc0077d3de0089041948f3574e55bd4311106c0dc42274ba0275bb27c2dadb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088957, "uuid": "bcdf555c-0399-4838-8f3f-a395ac90f8d5", "value": "T126050A91F968D9A5E5BB46B2BC2F68B114868E7EE65400ED157E33081CB2316E0DFC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088957, "uuid": "a8cda4da-e972-4baf-bc33-efe496efef13", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088957, "uuid": "49d31566-da2d-4e08-b729-b0725258dd21", "value": "12288:aYCP66ke/hSPI7Rjd+UpQNm0qFxPjydYlk6Cvw:aYCP66ke/hSP0h+pNbqboLvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694088957, "uuid": "e32abc2f-3ebf-4372-8cc7-f96d04290528", "value": 797452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694088957, "uuid": "45164cb3-6a37-40a7-b84d-b94dfa09b900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088957, "uuid": "d260f25f-6241-4c5f-ac04-57754d0ccf4c", "value": "ORDINE_N.202309028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008db381-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079380, "uuid": "09bfed9b-498d-473a-8c53-e05c10c90345", "comment": "Malware payload (Mirai)", "value": "3147600d25eaf4a897c60c29d607633f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079380, "uuid": "61b1a3c4-d80b-429d-bbe0-f0e0aa4b5448", "comment": "Malware payload (Mirai)", "value": "63929b761ff64168ae88aa580e911b0dd598f67e9c3a28f591564d3888b3e0ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079380, "uuid": "b35e23da-37d8-4ca5-a962-ffa660205ade", "comment": "Malware payload (Mirai)", "value": "ce0514d5bbd4eefc50dbe4ea7dbb013245ddf2b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079380, "uuid": "47071e46-a846-4963-ada3-6f695ea4d798", "comment": "Malware payload (Mirai)", "value": "5caff43255b2417c5c15ca6e4a6dc51e3870bdcca00f9ebf58a5b8589ac8c755070a7b15add3308dd4f4b76758797844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079380, "uuid": "caed966e-9ced-499b-b0c1-8b1a1ca2c996", "value": "T1C5D2D12CD94D7905D6AD3DBA51CE96B9394CB0C0635DEACE17224458F727E8BBC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079380, "uuid": "f940a465-de50-435a-a671-9e1668414be2", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNpJbiWUl:1bDs06t4BEub4sU/MbUpml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079380, "uuid": "4c307b35-d641-4154-b651-cbd5fda9f205", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079380, "uuid": "cf25a3f0-a9e3-4df6-b364-897978e68b4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079380, "uuid": "3c7d6c92-8a88-4cbe-8ebd-b76143ffbe15", "value": "3147600d25eaf4a897c60c29d607633f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b122ee-4dd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694130747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130747, "uuid": "f15f8479-fa64-467e-9a06-9aa49612b530", "comment": "Malware payload (Mirai)", "value": "9c2ee873dd130e8a61b2cf23d8a248f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130747, "uuid": "cedc3e91-7d51-4540-9ea9-7de4f569dec0", "comment": "Malware payload (Mirai)", "value": "63c33cfeaac3a19122824e5d7a4d9502815132329293d98034bb74cf7843d6bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130747, "uuid": "8f473ad2-890f-47c6-9b22-a6643d549a27", "comment": "Malware payload (Mirai)", "value": "a4c21581801a7448459babc9d69f0ca9f8aaad74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130747, "uuid": "2cda88d4-8e0c-42c4-8736-75736d7437c3", "comment": "Malware payload (Mirai)", "value": "6f43e8a0fb8bae9aa0529d462eda0d34dab1bb2c35d74a81937da6da40241d0ea0aa6a4bffc69676464160f8523f19a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130747, "uuid": "38274059-bc4a-48fa-9cf3-64a9cdc30432", "value": "T1603339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DDAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130747, "uuid": "202532c3-d6ef-4163-b5d4-d7ad6c6d6e54", "value": "1536:gAmkKnnAvjccy7ZeDm4ECd+67ZdC2BjWxr2dJKQDf2:nRKnAvjcV7ZIECdxZdC2tirS3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130747, "uuid": "929aa063-fc17-4c27-9a02-79d0bf6a5385", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130747, "uuid": "d0205031-170a-4822-b891-d9b9cf896f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130747, "uuid": "15368488-1978-4e8d-a378-ba56f27f4e74", "value": "9c2ee873dd130e8a61b2cf23d8a248f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6967cfe1-4dd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694127230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127230, "uuid": "2bb0d977-07ad-48e7-922f-6ec772616856", "comment": "Malware payload (RedLineStealer)", "value": "f37408ab3b5ffdfb428d6aea353a540c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127230, "uuid": "f8549631-164c-4280-8e6e-0e33dc4302ee", "comment": "Malware payload (RedLineStealer)", "value": "63f7198759207f9a9bdfdb824e5484242b66204f860fda92192c4aef8015b1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127230, "uuid": "0c604f66-247f-4411-86db-49efe446ca54", "comment": "Malware payload (RedLineStealer)", "value": "69a9916ad118b360c914a3086192d836708719c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127230, "uuid": "fb5086bc-29a2-48e9-a2f3-1b174bc7f2d2", "comment": "Malware payload (RedLineStealer)", "value": "25bd8d4375f7d5862c401ed3730ea66f641438033db7d16a8123171af0ff807e11a6bdc104a22ecd330118292b439c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127230, "uuid": "a1a8d221-1277-4a04-b874-dad0140dbc32", "value": "T176644A0870AC4630D25B1D31A91C8BB07E75ACF626A665CB3E7A44DF2ED6392C3315DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127230, "uuid": "d25205c4-adf4-429f-a1fa-c24c0f67e0c9", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127230, "uuid": "c0a62cdb-e3ef-4d50-89bd-0b97ed5be1d7", "value": "6144:Yu6PWx9nd1kCh2Eon53iCvxjfslllliF/SEyTZr0op1SZ:YzOHkChgxjfhF/SEuHqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127230, "uuid": "3e7ffd63-f39b-4df9-b783-7878bd192006", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127230, "uuid": "c9da7958-4a3f-4437-a926-5eda3ee2b8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127230, "uuid": "819522a7-5a1d-43c5-8037-a7a03b849325", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7d5fcc-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084900, "uuid": "ada66126-4310-409e-90c9-6baa812a9d70", "comment": "Malware payload", "value": "4a04253b625e474f58799b1c3c3282a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084900, "uuid": "ce885ab5-5dee-47ec-9dc3-509b47c12402", "comment": "Malware payload", "value": "64315bc0308dbefd4a37f4bc3a1a6ef6cd9fb1ac558649823a39e483debee42f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084900, "uuid": "543afdb1-e78c-4fd2-b8dc-e1bb62901af9", "comment": "Malware payload", "value": "980a07c3ba25b77ed9b74bed9e952db5917574ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084900, "uuid": "322bb53e-e57f-431c-8ed3-fcfd87b38074", "comment": "Malware payload", "value": "48ff5e7d2c66eab2c19083bd0e91af21b630005c254179bfcf5f6e4466fa3ce071817fe74c6c2dc789f6108b39b902e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084900, "uuid": "c019072c-453a-4310-a984-cdcb07318e3c", "value": "T19395338F5505C99FD1094F3DF0F18998F2CF6784D14401A01D9DAEB27A7FE89AB6A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084900, "uuid": "243f74ed-b72b-469d-b331-513f88fd8e29", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084900, "uuid": "61b09206-6b00-437a-8787-f9d980e69780", "value": "49152:7orziPhHzCO1R2yUN00XZyuX+DDFVPIB/bSmTpNwUD2Sc3Zd:7ourR2tZwDFRIB/mwFsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084900, "uuid": "1819ca30-fdff-421f-8ea1-0752881dd4b8", "value": 1909770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084900, "uuid": "c9456874-92dc-49a4-8a52-79b6c50f39ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084900, "uuid": "2f6b5e9c-2dae-496e-9830-1debc0b1fdf4", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c76113-4d82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694093192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093192, "uuid": "44397cdc-6ed9-44f7-89be-c22dcce7695e", "comment": "Malware payload (AgentTesla)", "value": "07a990c64f79dd8d2807200271af253b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093192, "uuid": "aedbb1e8-b8ac-4884-8a46-116456ec0ae0", "comment": "Malware payload (AgentTesla)", "value": "644f193420b74e89a0667ebc749a843339b2c978663dfb5d97202ec9c7bf9400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093192, "uuid": "59f64f45-8613-42f8-b2a5-8d76a2f73bd3", "comment": "Malware payload (AgentTesla)", "value": "80c0293aaf0c22cf20f23f1ecd64bcfde9cabd5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093192, "uuid": "1c72f048-7e06-409f-9143-0097ed0d40c4", "comment": "Malware payload (AgentTesla)", "value": "dae00bbcb1b0d96423aa479d5cb58f9e2fea2b2287d2f2503330be67e7a4f9ba9e5f0d519dc766b20fc9eba806d03df7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093192, "uuid": "300cfacb-3d04-4554-b6b6-06ad4c828edb", "value": "T17564DB1015DFB88CF2B23FA317DDB5DA4F9BF7E21726929D2504030B9A66E44CE85A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093192, "uuid": "5d9693ac-80e1-4164-82bf-6432d4b1e356", "value": "6144:V2qyyyy0k92qyyyyaK+K+K+K+K+K+K+zbbunununununununvR2qyyyyt4q2qyyI:V2qyyyy0k92qyyyyaK+K+K+K+K+K+K+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093192, "uuid": "f793912c-ee25-4a01-a226-bd74b3e779c6", "value": 317336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093192, "uuid": "5586b028-123e-495c-bedd-ac601c88915a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093192, "uuid": "80d7c42b-5b0d-45cb-a2c2-49f79084e700", "value": "New_Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c553a1-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694096027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096027, "uuid": "67a5a41c-52c1-4225-8af6-2201d42bf12b", "comment": "Malware payload (RemcosRAT)", "value": "877252ca1373d737dcc1b92e88ee1dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096027, "uuid": "bee4de34-7198-4494-a690-531a5670211b", "comment": "Malware payload (RemcosRAT)", "value": "6483ccee0337b0393c9799ca324992b61655cf331cb31c79edcf3f1160e95148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096027, "uuid": "e149bfc2-65ac-4818-9e8c-a99fad350d54", "comment": "Malware payload (RemcosRAT)", "value": "4691090e4d63f5d2f1d932d5dd764adfdbead469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096027, "uuid": "7b8ece2c-e16b-49d5-b06d-7712410b8fd4", "comment": "Malware payload (RemcosRAT)", "value": "9e2479bafa3a7f9edc4d54a5576304f83bb1c5743a0f71ae6891407c5f5e122bc0c74b4f87aa192c44a21339ded05fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096027, "uuid": "ca22d89e-736c-4954-b413-c558d32b0672", "value": "T159B49E01BAD2C072D97514300D36F776EABCBD212826497BB3D61D5BFE30190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096027, "uuid": "c6637ec7-42a9-4952-83f7-96d8158b4bea", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096027, "uuid": "18510831-e3a9-4fb8-af12-7244cf147da7", "value": "6144:Su/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc76bv:Su7wNB5iedQ1RmPEVAWONjpcs/ZpWbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096027, "uuid": "9d354385-8208-478a-b570-f3f5343ece55", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096027, "uuid": "deef591b-bb93-4327-80a9-76ac98c9f403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096027, "uuid": "250d7588-8b87-4fe2-bffa-b5cf43042f51", "value": "decode_57720c008ef9423d750481573993d0041210893f1816f97a41b052554666b2a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cb86c4-4dc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694122399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122399, "uuid": "07b030c7-8ef1-4a78-938b-3f0af9b4525b", "comment": "Malware payload", "value": "38e2ca9b252ae91aa43003cc2f211e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122399, "uuid": "eea5a1c9-9952-430a-8593-b6f2936e5e2b", "comment": "Malware payload", "value": "64c4c2fbe84d0bac54f5cb2fb5635515dc610e85133ad68ecff926f36cd06d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122399, "uuid": "966d0b49-4cad-4b10-b2fc-828dc24687e2", "comment": "Malware payload", "value": "ae5b0fbab13b273ad7cfc51ea2de61d83273adde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122399, "uuid": "32534fab-4a6e-4762-9aeb-780d99e99dcd", "comment": "Malware payload", "value": "b53ce88accdb4016a923d67cf0726715f9f67a90f9b90c61917933e9836c3ee2b8f27fb4b15c86007799c2064b94d2d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122399, "uuid": "e4a92507-fad4-4c2c-98a4-48c213c82820", "value": "T15A16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122399, "uuid": "aa3dffa9-5936-47f1-b2bf-0bd073b91f6e", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122399, "uuid": "bacb7205-be5c-4d91-9a2f-ee02bc25b9d1", "value": "49152:wgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWkjXNO:+a71fQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122399, "uuid": "23745892-fa47-49b7-b734-4d8ec1b32eaf", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122399, "uuid": "df2b7083-564a-4c7f-b29c-29fd34daf8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122399, "uuid": "71a7cb3f-4e3d-4d21-8f72-0a545346659f", "value": "SecuriteInfo.com.Trojan.Packed2.45650.7883.17602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df00b7bc-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694086625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086625, "uuid": "e16d9725-e23c-43a0-9b12-38ee07459926", "comment": "Malware payload (AgentTesla)", "value": "f363ab2f449ab7506f31a196f7c50343", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086625, "uuid": "e57e3e34-9291-4410-afe9-58a0bacaf21d", "comment": "Malware payload (AgentTesla)", "value": "64ef58d3a9a1181090a34df1ce77377d2620f0d58aeed9a5ff47682979b93ab0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086625, "uuid": "4fb0a1dc-5a71-493d-b2b6-7482aeea0bc8", "comment": "Malware payload (AgentTesla)", "value": "f9afd10af020c786d6787e39b6bfcc19162e6f75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086625, "uuid": "564ab768-cf13-493b-8fd1-4150c93f2703", "comment": "Malware payload (AgentTesla)", "value": "94c3bf6a887d3af8b735e66be9917b13d27c7a80075f03acb96bc5a2f8ff64d61c781743380334adc03f93b8d1d4f415", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086625, "uuid": "b3208fad-4330-40d1-904f-3b07d178439a", "value": "T1FC729E6EC89401AEE70750BC01171861F7FCDDA7F5A6D91AB210B61884F5EEEC74479C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086625, "uuid": "696911d0-8945-4cfa-afaa-05e9cf917d74", "value": "384:SyXwGt4Wys8PL8wi4OEwH8TIbE91r2fRaJYVviNupKBp2/QB:Scw5x5P3DOqnYJE0vEupKBphB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086625, "uuid": "2201b945-6725-49cf-a70c-20c38234eac2", "value": 16432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086625, "uuid": "d08efa4c-dbab-4ad1-9d96-ccf9f8cb9d2e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086625, "uuid": "b8810e64-618c-4aef-8aed-64e44c63c56f", "value": "order#10038574.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46497f9c-4d90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694099254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099254, "uuid": "1d0a07db-90ea-4937-a8d4-0981422056d9", "comment": "Malware payload", "value": "5e468d307e7c7b54a6a296cb8a48815a", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099254, "uuid": "2c6a75f0-e820-4aed-85a0-5fe736fa849d", "comment": "Malware payload", "value": "650dddc5cef5400a9ffdfbb4b54165059c7eade0acab4d9453dcfb003989d066", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099254, "uuid": "cf14394c-3f34-484e-9123-2cd972fdc67d", "comment": "Malware payload", "value": "dcf013bb3486d744b66def2f643c829fb1173f8c", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099254, "uuid": "b609cddc-c0ca-43a0-a4d1-876ab69e209e", "comment": "Malware payload", "value": "ed6b195b885fbdb759014121334e14323aeb4bebf42f7a1d13d460be4e3c479361cad0394a61cdaf2005511f4507461f", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099254, "uuid": "e680cc8a-a752-4f10-829b-ece2d6f60085", "value": "T165E5333C15DB3457E8B730394EB8E61C94B20A68B8853726D0E5BF38ADB5414FB76728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099254, "uuid": "1bab2693-07e2-4339-b7a6-10e3e9e6d129", "value": "98304:yy6PJXaIp0Brg56tJfsIMwkXqrks7a5Zz2y:EROrK6tFMwfra5Zz2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694099254, "uuid": "77484a80-1854-42ce-b9b4-67b0965a8736", "value": 3181575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694099254, "uuid": "934cbe15-ab39-4b93-bc75-ae4d08dbcdee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099254, "uuid": "ab6c7939-4ecf-4934-acd5-0fa1ee8d61a0", "value": "brwrs_enus(updclientversion).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78956ca2-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069274, "uuid": "0581511c-16df-44d8-9143-0ad6740d4598", "comment": "Malware payload (AgentTesla)", "value": "ee986df1c36515232336c3331691de5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069274, "uuid": "deeb6b37-03d6-487e-bdf2-ae3768925b68", "comment": "Malware payload (AgentTesla)", "value": "6588c3f067d344a83aeaac2f3828f33a70b899fe9dd5129305dc0354cdfb6f55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069274, "uuid": "3291e456-119e-4092-b1bc-519201362bfc", "comment": "Malware payload (AgentTesla)", "value": "e82f9115bf9342a6115998c42f96663487c022ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069274, "uuid": "e15fb16e-3d23-42cc-9c29-fc272e1753f8", "comment": "Malware payload (AgentTesla)", "value": "160672aa74f238fc77e1f8ba5e292b93a7a6f5f69019339013f294c6c156ecbdfe71595dc3fc94bdcceca15b7eaf4620", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069274, "uuid": "ba0a64b5-5c6a-4850-9404-5efce3176a3e", "value": "T145D4233ACDE395A5A54B4E35097CF127AC346105579A930F3D27320BE72A8CF93BDA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069274, "uuid": "a7c3ad8d-3af0-4b19-8fc9-964805d44b9d", "value": "12288:OoW1QVKa67K7f7ZbWAU/vsKzykddZY20VJ2di+12bWMK:OoW1QAabDjPmKJGAyMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069274, "uuid": "11cac708-3c4d-44d7-ab4a-35b08921c9f8", "value": 597978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069274, "uuid": "b952c980-6e97-42eb-8910-ad41e05bc470", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069274, "uuid": "1d242a31-8609-4069-a595-073cafd17c20", "value": "SOA.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a96de44-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069089, "uuid": "6f8d0b78-086d-47d7-ae2c-f412f258328f", "comment": "Malware payload (AgentTesla)", "value": "e52858bd51bffc6fea3d9940cae8b7b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069089, "uuid": "7430bf6f-0579-407f-b3a5-7a0c3a498f17", "comment": "Malware payload (AgentTesla)", "value": "6599da7968ef74428e7187b46b393a72e7595b691d8f83c3fb12a2800f0f541a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069089, "uuid": "340b1b03-33fc-4677-9f05-2fae2ab0b3f7", "comment": "Malware payload (AgentTesla)", "value": "977850d06b75b2b0d613d449d166521a996e53b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069089, "uuid": "7da8ac9e-c04a-417f-971a-1097a1f6a2ae", "comment": "Malware payload (AgentTesla)", "value": "5cad71062cbf783d6bc0be33376ce4ac3a5bc4bc5d1d65c0d9ae4ad391e8d098119dd9947c12d9872f5911ce34ffc405", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069089, "uuid": "554d053a-995d-4a3b-9c18-ba04599babe9", "value": "T1DFF42342CD98E3C417E4833BF1FDEFFB5806E266B60B9A5A297D146B507D0CA4D981C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069089, "uuid": "f1edeea2-8158-4251-aef3-01511f2c7394", "value": "12288:iwA840VkY3qAGOtPtsJmpJ6DVV4rFodTqYWmUXyQyeSyIU95JO6/y4nYj1euD:iwV3NGtW6DVVdd20UXyQy/uJjnYj1bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069089, "uuid": "6f76ff07-e6c5-4bfd-b7fa-353bd7febbd4", "value": 733879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069089, "uuid": "32e00f6e-bc6a-43b6-b421-3f7c657fafc0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069089, "uuid": "2407fe34-ff2d-41d6-b371-53f2c7326498", "value": "DHL097838579.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d2257d-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694090855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090855, "uuid": "7f47e9e4-d58e-4af7-9739-1a9fda692177", "comment": "Malware payload (RedLineStealer)", "value": "97c08daf5efb433e6f469af5a2a49544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090855, "uuid": "fdcb5812-1119-4bdf-b76e-8e2414ad4543", "comment": "Malware payload (RedLineStealer)", "value": "65c8e7a33d7982b2f2a218fb7dd5554377b402b8e58eb185cf9e5dae62285eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090855, "uuid": "01708037-e86c-40ba-a1df-82219f9c594f", "comment": "Malware payload (RedLineStealer)", "value": "1e41a57c1f4ddb31d884d00ed6c84fc5017b4589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090855, "uuid": "a6f6c970-3549-41e3-941a-76dafdda860d", "comment": "Malware payload (RedLineStealer)", "value": "a727e5822eb0e70c645465e8a2a5f6fb54120a2f7207c7dbfe189d07163e967df52e1332926014514ad2e870316441e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090855, "uuid": "37e2a6f1-9bc6-4183-b926-d553b2af988d", "value": "T159644A79268BF11FECD044B01E2898A006ACF3E8FB9D7F77C254581AD614BF124957AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090855, "uuid": "c85bfb81-5a4d-4c5d-b463-ffe2a523db87", "value": "caa8d22a27bdeecfeb10143eed185335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090855, "uuid": "5d4cc54d-1748-4fbf-947a-35502971c69b", "value": "6144:tEpqplhoSByJCTT8nUMFn27aMvfxTayUkBi30IB:tEpIboSByqAUMQ7Fx5UkwEIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090855, "uuid": "084a5540-b06d-4674-a626-4a6adb6c50d0", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090855, "uuid": "269b7c31-9458-4ede-9429-bbd75938a7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090855, "uuid": "65cfa8f8-13cf-474e-a958-601486d9c881", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10107a1-4d37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694061262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061262, "uuid": "34650031-e5a2-43cc-b853-fe84a15c843e", "comment": "Malware payload (njrat)", "value": "751125b93116fcb44bfd476b01a819c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061262, "uuid": "97cdd47f-90fb-4ff3-8b6a-f7d5a0ac4be7", "comment": "Malware payload (njrat)", "value": "663c2b9e7d92bf199c066fe3f0f7f99092d280993ffabee22b42483b55d4b4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061262, "uuid": "8b438df3-9bbb-4df6-bdd3-ee9febb8cebb", "comment": "Malware payload (njrat)", "value": "eba17c2b038c6a3fe17d6ba81e0ed8c26a3ff500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061262, "uuid": "d5c50f29-4548-4715-9962-e78170bfcf83", "comment": "Malware payload (njrat)", "value": "bb378bc2184fbea6aba9909d2cc5b854e9ee50d7e3e48e6a28f758f6daf9a0533d07f65a4f7f6b063b7c4e54532d503c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061262, "uuid": "202c07f1-923f-488d-87ff-d185a4c7fd89", "value": "T1EFE208067BE94215D6BC5AF88CB313214772E3838532EB6F9CDC98CA4B676D00255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061262, "uuid": "f46b79f8-d4d7-402e-a370-e2bff4d83a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061262, "uuid": "3e4f9d2e-ac98-45c7-b619-443b7ca88de6", "value": "384:O0bUe5XB4e0XfOZzw0Q0mS03AWTxtTUFQqzFwObbV:fT9Bu2C55d6bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694061262, "uuid": "b2453cef-9ab4-4668-922f-1fa57763ed95", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694061262, "uuid": "6aecbaa7-e40c-4ca4-b623-4d6864480891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061262, "uuid": "bfcde7bc-04f5-4888-b29a-e7a3c43b9d10", "value": "x4UJmkZEV2Tj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7bf697-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111643, "uuid": "4b5a16d6-6486-48ff-986a-18b122a57a29", "comment": "Malware payload (BumbleBee)", "value": "b397d94493a37c789647bc3d17fa6920", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111643, "uuid": "aace4574-a3bd-4df0-ac84-ec6673b3327b", "comment": "Malware payload (BumbleBee)", "value": "66535813e58e078c4a56c502b6536725080aef5f17abf62f57348a574caccaf5", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111643, "uuid": "a2617a06-d157-4715-b69f-82a74171b67e", "comment": "Malware payload (BumbleBee)", "value": "bd7dabb5c87e9e80160f6da942bfd26849e8494a", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111643, "uuid": "ca58e536-d0f3-4550-a383-5a17f4aaedad", "comment": "Malware payload (BumbleBee)", "value": "590a6a9a3b025d7212682fdae1584ec5734cca3a29d09dfe5cc56358b75391b17d03a37c01f038f467922a45ca0263b9", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111643, "uuid": "9cb6c996-ba2b-4af3-90ff-2f76862df7d7", "value": "T1B2D4C08FD9A1FFA9C41D52B3C89F02AD1263B2402E06097BA56D124832E3B0777E775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111643, "uuid": "46179adc-bfc8-4592-b37a-56602409d732", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111643, "uuid": "5ba9f047-51f5-4c21-8ce2-477a75ddcdbd", "value": "12288:zGOWNipODV+gjelTCvc8AtzkvkBFJaC/p5lakvyKmUlZ2j:zGOZYVFjelWkBwv6bp1vcUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111643, "uuid": "b8ddd1f5-7fce-40cb-a9d8-8e3884f3fdcb", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111643, "uuid": "84ca052e-4cbf-4848-9cdd-fd3b5e7948fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111643, "uuid": "b18da3b1-b8e8-4e52-80f6-085440860989", "value": "8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5f60e5-4dc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694122403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122403, "uuid": "22ad70ac-30d9-4030-87cf-d748a3af8880", "comment": "Malware payload", "value": "1a497481dac9e4f5ccae89bbd19e3096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122403, "uuid": "c36c1569-7c48-4eba-a24c-975149586df6", "comment": "Malware payload", "value": "667f2d0c934d3ea21a75baf0d955fbc918129f64eb37f2cbdac02e4eb5cccbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122403, "uuid": "3b8d6e0e-50b6-4e6c-aeba-6b584376b302", "comment": "Malware payload", "value": "920a043ea81e751d550c7aa3a47618a615f13fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122403, "uuid": "d7e566bb-ae3f-4e7c-878d-9ab5f0ca8b59", "comment": "Malware payload", "value": "98667297f613219993c33dc79b171cf8e391e8d19ac35b59b1e72729fb7854fbab3fd9eb4420614b8c1715f50ddd7943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122403, "uuid": "427ab8c2-af3b-473f-a635-1ab9cc970028", "value": "T1C0C4239977340B6ED27692F15C366FC33F324B2439B0F394916868CE4E12F974629A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122403, "uuid": "ba3e8668-ac53-40ec-b7a8-14e8ddd9cd41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122403, "uuid": "ae46de80-cb11-4558-acbd-4c3527e8ba59", "value": "12288:KbxWo9v+Z/FKcP/WePfID3NOFqWxWjYcoERfB3sc5pRHrXJ:gxjlYAcIZOYWyoMBccbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122403, "uuid": "3b9f0966-d611-443f-b610-7252b84e66b7", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122403, "uuid": "0e4baf9a-0506-4ea3-8ee2-46d6f86223af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122403, "uuid": "02f0674d-ba81-4267-81e3-ff89dd624b48", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21761.29978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7b8119-4d37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694061147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061147, "uuid": "ff031f0f-fb03-4698-baf1-63ac2c2930ca", "comment": "Malware payload (Formbook)", "value": "1827695fc12025f46d4d93416603d7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061147, "uuid": "dc730a5d-f601-45d0-b804-9f6a544fbae2", "comment": "Malware payload (Formbook)", "value": "6695e4331e8ce9706466a68a03272ca2e09fa21141d08fede561a93eb8962c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061147, "uuid": "3fdd6fa0-6fda-4666-ae4f-31198eaeb8de", "comment": "Malware payload (Formbook)", "value": "6b10e0770d95163bf44af9f9e6be7918f37cd35e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694061147, "uuid": "2a1dc344-21b9-4b69-a65e-1fcbcdab97d7", "comment": "Malware payload (Formbook)", "value": "f047e693f391a80fda34770b0164386d4a20d9dedc841402333aba34a0b845445a7267f04579a45107ba2259c84d229c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061147, "uuid": "40036db3-3785-4046-a27b-f88b1848110d", "value": "T1C0D4D09C361036EFC85BC9729AA42C64EA6075BB530FC203905716EDDA1DA97CF261F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061147, "uuid": "392e2509-60b6-48bb-b799-2aab4b2e55f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061147, "uuid": "9d508123-1469-489a-8be8-b4de1811206e", "value": "12288:vTtV7ifm3RBIuYsb+VlnYSrSIIbSxDhheI/GYUgTwHVku5fVsbRFDEveDpTvA:vxUfW/vElbDhht2VftO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694061147, "uuid": "ad230159-a923-4350-9b49-c9369c3497c6", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694061147, "uuid": "51cd95d4-19a9-4e2a-bd06-53e4fbd724ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694061147, "uuid": "2f5441da-007d-4576-93ee-9b3bb1e83c3e", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.17768.3885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195d28ca-4d83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694093595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093595, "uuid": "52ffc3a0-0058-464d-b3a2-5a8908f871fa", "comment": "Malware payload (AgentTesla)", "value": "9753a8454818b1153caadd3e3ea6c365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093595, "uuid": "608465b1-b30f-43db-a5e7-2e7f7586191e", "comment": "Malware payload (AgentTesla)", "value": "669ea7e10648928c344d73f35e28f92a33702a8636be337b389145a94e065c2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093595, "uuid": "16177432-6549-43bb-b9f2-ec98b375002c", "comment": "Malware payload (AgentTesla)", "value": "ca7bb6712fc7c1972d4ab6d5046d4652ad33e5ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093595, "uuid": "42f9c6a6-91af-4187-8c47-802fc8de667c", "comment": "Malware payload (AgentTesla)", "value": "5438ecf042b8dc7eb0ec6f47484d3084d6383410ebe21832242f199330cad2f868506ee7b1ef916102e144c300a526a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093595, "uuid": "8bbb2d79-e05a-42d9-b2bc-726ddaf99e83", "value": "T149232629934F01A9CF62523B9B2A1E4541FCBB7EF68451A5306C433933EEC3DA1256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093595, "uuid": "38cf0d0e-595f-49c6-a22d-267756c161d2", "value": "384:HL0AbZSikcMX93wRWjEx9Xvb+ECflIrQxNJxrj5dbz0Rv+II7NzsLjI0O:HwAbZSibMX9gRWjo1SEGjN3HKLE0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093595, "uuid": "dbe8dd69-4e80-4729-b340-f3064e2e506f", "value": 47414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093595, "uuid": "619d89b5-1e8c-49f4-9e19-54b740e44dae", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093595, "uuid": "97e48d65-62c7-4ce4-9a10-4fded6ba4a4b", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.22638.11164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3621ae7d-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "280467cf-1366-460e-931c-1b006baa1fa0", "comment": "Malware payload (Mirai)", "value": "6ad34cd646470607bf8f99d7912c58f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "7192a063-6654-4722-8136-fc26704082e4", "comment": "Malware payload (Mirai)", "value": "671ab85595f66e197f50469e80840b35c8b3bcaf94f576ce3dfd5bb20ff99cd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "15c4085c-323a-4651-a55d-b0a76d80751a", "comment": "Malware payload (Mirai)", "value": "33390302902b6917aa8bda7f332cc8f07c181e8c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101804, "uuid": "220077a2-dffe-43ca-84e7-d3672e62d2b3", "comment": "Malware payload (Mirai)", "value": "f5e3db89939e5cf69c1039d53054b5f50fb37883fb54ee5d75d37e8bcf25b65b990406c9836d1269fcccc7f2e6061d3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "9df8a49b-ec55-4c32-84e8-7c69c146994b", "value": "T125330262276E29E152B09777FC32BC1A669C1BB85C67309A2CF0961977C18024FF6782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "39bed060-eb5e-4bc1-9b13-f84be21be5a7", "value": "1536:69O/ZMAXIxNUk07ELcPqF1aBexo4opKZbRk:69O/ZNKyELGqFUF+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101804, "uuid": "ed683492-37e0-4fb7-9eab-81c31390fc3d", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101804, "uuid": "6cef51da-7360-4392-bae9-c34be0375338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101804, "uuid": "830ad582-6468-4117-afac-55693224ded5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ac6e5f-4da8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1694109826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109826, "uuid": "cecd5705-78f0-41e7-a6d4-c0a39ac27eb6", "comment": "Malware payload (Adware.Neoreklami)", "value": "0f6897e316e65dfe9a4cfe8d23e1c735", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109826, "uuid": "361eac38-30e9-4ef3-9758-6216643379a8", "comment": "Malware payload (Adware.Neoreklami)", "value": "677740e54ae7f4070bd91506e752d3fc1b481b6d52fbc205ddcd9cc17a7404dc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109826, "uuid": "bb1f26d6-531f-49f0-a8a6-a06e8566a1b2", "comment": "Malware payload (Adware.Neoreklami)", "value": "87ad9e42d6ad0d14db374015bb101a660574fa11", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109826, "uuid": "e41aa6ac-245a-4f82-bfff-efc9ce890a21", "comment": "Malware payload (Adware.Neoreklami)", "value": "fd5f98faa082d4b1984a399c09bda05aa267976d75a690edb5075fac662cd2ec709e280a22a9e37be93832a9b34ec2bb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109826, "uuid": "8cc6a4a8-16bc-42a1-81a1-d6be8e67def9", "value": "T15476331C39E0D9F7E5D304700E461B49CABAE8394E35E26313CB0F24ACB9ED6A9517B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109826, "uuid": "9505dc7c-0d62-41c6-98a4-ec32569a909e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109826, "uuid": "71b6d20c-8b29-43c0-bb8b-397c51a934f6", "value": "196608:91O9OXU7oivvLdGvc2uQfBLoB19FKZSGTXyZ+1v/h3IP6o3PBp5V:3O973pG02uQpLW84iv/h4io3JV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109826, "uuid": "8b56dc0d-8861-4eb1-a936-158a13aa0a4a", "value": 7621113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109826, "uuid": "838423fc-32ff-43bb-afa0-15ff4f4a4bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109826, "uuid": "f0550e8b-0995-490e-b7c4-969d7688427e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de938dde-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119266, "uuid": "e2440ada-ab78-48ef-9981-bbe743c023e1", "comment": "Malware payload (Mirai)", "value": "271e7c2047364f383ec5d9b6453ee8f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119266, "uuid": "acbac709-ddcf-485c-ab9f-98fd2ccc0738", "comment": "Malware payload (Mirai)", "value": "67b848be65915b0ea16d39cc035fab96093b50884b4167538d02d783787d301e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119266, "uuid": "e1cabcf3-2e3e-42de-b679-8420b2e21383", "comment": "Malware payload (Mirai)", "value": "117c1a5adb34b3405256421fef5691c814db8fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119266, "uuid": "3b752daa-7854-4dd6-ac55-811cdbf0856c", "comment": "Malware payload (Mirai)", "value": "0e6fb4d6571ad280c3b4f6edc6e5257b6d7af8dc1c5d4d03c7189f8c40a7fd2cf05783f2696e6dac03c5f7a52a992654", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119266, "uuid": "9a57ddcb-f42f-4111-8568-ffef22d7ca6b", "value": "T187336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119266, "uuid": "8f023885-27b7-480f-9154-e2e4004409ae", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119266, "uuid": "67fb4ceb-f9dd-41a8-b703-da134a349bab", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119266, "uuid": "055995ef-0a80-4c50-8ad0-04bdeee397aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119266, "uuid": "154ae8b1-59e2-4b91-b6e1-896ad930209e", "value": "271e7c2047364f383ec5d9b6453ee8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d2287c-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084791, "uuid": "256ddde7-7d51-4aca-b01a-f789965ecd5e", "comment": "Malware payload", "value": "c4463f09c3c15901a0f50a3d50b963d7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084791, "uuid": "1adf0008-69ed-4724-9f77-03ba795a1443", "comment": "Malware payload", "value": "683516912ba44027a1d5121d53f176e0ac12f24d6e7c135d5138fbcd9e4c71e4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084791, "uuid": "d4ab48f6-c92e-409a-95ce-f708147b4199", "comment": "Malware payload", "value": "96deb29b9a5575d8eb0fb1c65680326b3f955285", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084791, "uuid": "5a2392f0-bcb7-45f4-b99a-43e44b31a9ca", "comment": "Malware payload", "value": "65758f6f5dd1f50c35e44e2487220869e8ea5a152133b8e2c8f7a9d41145869d27574570a63250449058dfaa97a724f0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084791, "uuid": "05dbbf2b-9d26-4916-94a3-e5dc06f5972f", "value": "T16EF30CF7EA43D40BEA9CCA312C9D7FE192D56A25679D07CE5908A21E0EBD140CF73861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084791, "uuid": "b3369f20-30ef-4a0d-acd9-0b992625f7a8", "value": "3072:nlxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA0y/j9Mo8yTcfc:lxEtjPOtioVjDGUU1qfDlavx+W2QnAhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084791, "uuid": "dd7e5a21-2e84-4136-95a6-83b548afb8ac", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084791, "uuid": "1a2a356f-fd69-4b70-ae2c-403810d6e50a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084791, "uuid": "db9f2761-0faf-4475-96e8-64302c420395", "value": "c4463f09c3c15901a0f50a3d50b963d7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9730c5-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694068099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068099, "uuid": "a1356b3e-fcfb-4f51-acee-5addc6d2a7ab", "comment": "Malware payload (AsyncRAT)", "value": "c70202485120893f205e81dd77a5fb9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068099, "uuid": "f06cd99f-7ba9-4594-b519-f11a6a520962", "comment": "Malware payload (AsyncRAT)", "value": "6848802931eca8df0b711d1b38d452579a62fa1ba255b4b78e8900c82bbe6752", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068099, "uuid": "cba7a543-649f-45a2-815c-0a5967261bb0", "comment": "Malware payload (AsyncRAT)", "value": "85d13137377ca85a07cbbd98104284ea6eea3641", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068099, "uuid": "b6257cd6-b4a0-4256-9e34-73f7f78ff315", "comment": "Malware payload (AsyncRAT)", "value": "de33902e0f51b98eca8e4961e2a79681c2770ff856d4ef845206e04f87594a40f9bc5c1c7e967ffe836a0d232cfcf6f6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068099, "uuid": "efcdcf6b-e20a-49ad-9c17-af6f6927fa61", "value": "T17C276C0037A9C961E2AE86B8BCF2154006B6C6772112DA5E7CC811CB5B9FFC50752BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068099, "uuid": "7af0de93-4a6a-4f60-bc08-90614381be3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068099, "uuid": "25e2e572-eeb5-4d5b-bf00-fe2c3d85106b", "value": "1536:1Rnr4PHXtFRYUb0h9n9B1lau+jpqKmY7:1F4P3tTYUb0RB2Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068099, "uuid": "938cbb43-01b2-421a-9734-7519e5074b09", "value": 20938502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068099, "uuid": "32d0c6f0-f9e9-4437-aee3-cebe37717114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068099, "uuid": "ff6c9386-4c0c-418a-ab62-8e7956226424", "value": "c70202485120893f205e81dd77a5fb9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76920d60-4d22-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052090, "uuid": "f5bc8628-02f0-4eb6-96df-0bf7b33384d2", "comment": "Malware payload (Amadey)", "value": "25d51ab8cbc9dfe97d158086976f2ac7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052090, "uuid": "ad2bf68b-92ea-4d3c-92cc-ef0cd7f4a70d", "comment": "Malware payload (Amadey)", "value": "684a2911ad06a52e144ae4afe30e77ccfbb557641ee3a3d9e0175fc0966173bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052090, "uuid": "ffe991a4-f418-4ad4-82b7-4b024164b733", "comment": "Malware payload (Amadey)", "value": "7e8006c22a73c3d7b0becdb7f2333536703ad492", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052090, "uuid": "6cbee64f-b9c0-4a19-b5de-d097a17c7d25", "comment": "Malware payload (Amadey)", "value": "debbc655ab348dc8672b4516271ac4f49a09c24abb0d78418b9056be36576a1c69a034e7f9d26641adf9d9ef6d2a1c1c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052090, "uuid": "1c8ab3f2-6eff-4b6b-a910-e1ac32a95b20", "value": "T1F224F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052090, "uuid": "384df5d9-5059-4e20-8e28-32901ebf8674", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052090, "uuid": "465e8820-5dd4-494d-92d3-0b3928df225b", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052090, "uuid": "a4a28cf7-a49e-4b3b-a150-b9d98d98e725", "value": 225606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052090, "uuid": "4c1a98d4-c029-4dad-9866-08bc2ba386a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052090, "uuid": "ffc9210e-609d-4a97-95b3-1cc65363aa3a", "value": "25d51ab8cbc9dfe97d158086976f2ac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63f6cbc-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085295, "uuid": "9b6ff893-b9dc-4b40-a3ad-b0891758a948", "comment": "Malware payload", "value": "5f1bc67cff7862e822abe90cd6b5eaff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085295, "uuid": "e45b8fc5-67a1-462b-bdef-7c861204cef7", "comment": "Malware payload", "value": "68a8bb66ab1aef8eff7e42555b548a5876901790973c1866c38052e2f39a83af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085295, "uuid": "09f3e0ef-157a-4536-8d3e-5d0f9ed2ad7f", "comment": "Malware payload", "value": "1e0638711fd8e9df2126f7eb8d0e91485f14e719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085295, "uuid": "df80a6c8-e782-4a87-a430-e8338f2fa8f4", "comment": "Malware payload", "value": "8438dbb3da853ba3dcdd71610d9a7f541e3352bb1ea5343979f23175d0a864104e94456e1a10c41a9046593de7c2a92c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085295, "uuid": "6fd0c529-cb46-4628-b76b-0e0e058a8ee4", "value": "T12453AF2444736D36D8BB0B7311C373B7FEAC81D00B7A62385A43B22561679E8DDDB686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085295, "uuid": "ec57431e-820c-4f05-b3c9-5937beb7d22a", "value": "a64e048b98d051ae6e6b6334f77c95d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085295, "uuid": "25632002-6b5e-4313-bda3-2ff83a837949", "value": "768:AFJw8Ga3wLEtNpm20FK1CgSLLcVgGaz6Jx81gtq2vA0FeLQu7/1H5dhh7JNuIxeE:xhEHsXKzVgGaz8A0F0lj7JNTwyLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085295, "uuid": "1ce7190f-f2c4-48c5-be6c-2752c84ccf25", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085295, "uuid": "152a4be8-a182-4053-8da5-69c4d3318c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085295, "uuid": "03a055f2-0048-404a-82ff-1bd836470279", "value": "Virus.Hijack.ATA_virussign.com_5f1bc67cff7862e822abe90cd6b5eaff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98580a1-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075476, "uuid": "5c1723e8-9b6e-4857-ad1e-1d059db7361f", "comment": "Malware payload (ConnectWise)", "value": "6ac9bcdde7ea981ce5554b38d9e4f8ff", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075476, "uuid": "1835d173-c0a6-4990-b9b3-fff36bb16e61", "comment": "Malware payload (ConnectWise)", "value": "68cec786c5dc805aa5c4ecd5944fc67452dc0b2ed662304a2172893fbd4f7189", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075476, "uuid": "70a6e56e-2fc8-4ead-8377-c9a5c6200e59", "comment": "Malware payload (ConnectWise)", "value": "2543c0dc53ef49c371682de92844de7c69369930", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075476, "uuid": "efcfe79b-f5a4-4fd4-b3fa-2ecc2b2df84f", "comment": "Malware payload (ConnectWise)", "value": "58c8274a9ce2f4f43532f9291a3535388487d69da6a64afad4f7d50f062d310711340ed219f423416c25472db34a4740", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075476, "uuid": "49f8acf3-7511-4f84-92f6-83d2b07a6367", "value": "T112938D03B5D19C71E9721D3129B1C5A15A3FB9211E748EBB239802AE4F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075476, "uuid": "57698ad9-faf8-4c10-8810-bf048b9a0840", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075476, "uuid": "9b8b76e8-032f-4ef2-b17e-3edb7db14f67", "value": "1536:NXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWR7jPx6j:tE3x5KBDYiKWm/iSw0fRMvygR3x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075476, "uuid": "96497dcd-0c6f-490a-8539-69176dc7d1e9", "value": 90376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075476, "uuid": "9c9d967d-ef6b-4c1b-b9ad-1cd85d764f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075476, "uuid": "623c5c29-7980-4841-8cf7-69ddc7fdc2d1", "value": "6ac9bcdde7ea981ce5554b38d9e4f8ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a931bd93-4d68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694082240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082240, "uuid": "e6f66746-ad6c-4a91-b23d-fbdf6cb18c7c", "comment": "Malware payload (RiseProStealer)", "value": "104192388124ad7592278ea0425082db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082240, "uuid": "db6049e1-9a71-4c4a-90ef-f99b5f4a24b0", "comment": "Malware payload (RiseProStealer)", "value": "69010ca4bc815b6422d4985a311a1331aacc1881003ce25e6fe9ef0ee48e0a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082240, "uuid": "42c30aff-6659-4641-8b48-450f7453f574", "comment": "Malware payload (RiseProStealer)", "value": "7269b482aa2c4432b91c90911412719d2bcd17d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082240, "uuid": "fa32645c-6152-41ac-9226-848fda352e15", "comment": "Malware payload (RiseProStealer)", "value": "f7b1c4e89b241661cc4d625c8d7dd4fca3fb548870afff79f1379bcb5dbba5ce17d5a69c581a17a595dd80e62e6160af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082240, "uuid": "ccaec97f-aca2-4839-a83b-c0d9f07a2bd5", "value": "T18084BEDC7AA471DFC85BC872CEA81C68EB9164BB871BD203E46315A9990D997CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082240, "uuid": "67d27be7-7d08-4a7a-86e7-45512f583724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082240, "uuid": "4ecf035e-64ce-4036-a2cf-b8b98b8fde89", "value": "12288:8xLia+nRoSCvZAHW1w1DMF0/l7wrQqTcbcdlIQXJ2uvk9y7Wo:IWzRWvw9Nds8vQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082240, "uuid": "6d8ad1f1-b901-420d-b880-a2f4ff7cc149", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082240, "uuid": "9cc94bf1-b3f5-4350-a873-3cd6a58a5115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082240, "uuid": "df84b712-09b5-496f-a709-716798ec17ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43b2878-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694103277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103277, "uuid": "b09083ec-4bf1-4b24-b28a-e0ab64680ebb", "comment": "Malware payload (Formbook)", "value": "fecddc149028faa02dacf819bfde9e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103277, "uuid": "f296627f-4ccf-404a-8224-7a82ab1ef514", "comment": "Malware payload (Formbook)", "value": "690fc14f8b0395e7390646c6832d462bd421bc7caa1caa5f66654b7252a0e102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103277, "uuid": "a8cd6282-c54c-4147-a0f8-9681869d2e7c", "comment": "Malware payload (Formbook)", "value": "79d44b6c35cb10d2d91698d4023866125d5c2489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103277, "uuid": "4e1ef08b-123a-43f1-a281-e46be00df4fc", "comment": "Malware payload (Formbook)", "value": "ff38c6af4a93ff1b8d968e4afa9ecb9d8c34e7746dcc51b8c5e40777943a467ca57f90aac8126aabed62afda6c7d604b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103277, "uuid": "71ae4122-f006-4c48-9d03-03c176959686", "value": "T1B3741214BD54D09BEEDA53722ABA2B431FE294179C10D34727200F8DBD63AC9E61E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103277, "uuid": "64f9d62b-2a33-4d67-a05e-b55af752656e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103277, "uuid": "14eff4fe-19f9-41c4-9816-77ae4cb61ea8", "value": "6144:PYa6YGlqHGYbM2YtSl+uEXbMnZo5esXPAvsuALrA3bo3sYDD7WA:PYmGlqmYbM2YtSrxZYXIkuA57WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103277, "uuid": "d6df3095-22d7-4f6a-a2b8-8558c16ddb34", "value": 368261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103277, "uuid": "ef9c52e6-9bfe-4f12-8026-2c668d104a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103277, "uuid": "18db99f1-767b-48e2-9964-68e39cd96f46", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7569f9c-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096035, "uuid": "a935167f-94c4-4c4b-ae60-bb8d3f5a975f", "comment": "Malware payload", "value": "6751ff146d579a7dc2cfe848a8bcb04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096035, "uuid": "0fa78643-c412-4c10-a373-3d910f98e30e", "comment": "Malware payload", "value": "695cb4b8960542da87f4218a16baa9aaaaded9d6c2e8c2bf243163987183e6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096035, "uuid": "9a8919db-eb06-445d-b3a3-1892dc7f4933", "comment": "Malware payload", "value": "5af9ce4a05fd7133fd0bb4dcb8b59daf305fdfe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096035, "uuid": "fb69eb06-e8d4-4d44-820c-dfb15d8b6c8b", "comment": "Malware payload", "value": "655c722a749cdbba51b0d93e1386956aaafc580b9cb302332344873bb951af0cf2f122d28939bcec023116178918a89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096035, "uuid": "e6273702-52bd-49d8-b612-e37e808e7432", "value": "T140236D4037D88136F2BD8BB5A8F292458679D26B5903CA496CC815EA1F13FC696036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096035, "uuid": "7c98065f-4f34-4c6a-b3fd-ff77eaea139b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096035, "uuid": "b39c117d-1ea5-41cb-8335-948fe77d1ad9", "value": "768:Eq+s3pUtDILNCCa+DiPsMmaCVi/G8YbageD5LvEgK/JDZVc6KN:Eq+AGtQOWZzzbNixnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096035, "uuid": "976af8ef-895f-481b-b782-b3ca67ee27a0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096035, "uuid": "a6d8cbda-8527-4205-b4f6-8f85ab84659e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096035, "uuid": "b1aaccec-faa0-4920-b1a7-52ab304ea118", "value": "decode_80b8351395c83f75cbc0df8eea1dc86e347842273e3218cb411bf7ba232bc49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48aad15-4dc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694121397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121397, "uuid": "371a036c-5cc8-409c-ae7e-31a3b9abc206", "comment": "Malware payload (MarsStealer)", "value": "443f4ea817fce5e318ea2c9948407a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121397, "uuid": "100d659e-0331-4d39-bfa8-d824a8bb4d28", "comment": "Malware payload (MarsStealer)", "value": "696d64c3563697e72f29c5929bb7071930e1ac13ea0ca338c4a4849398604c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121397, "uuid": "3a2f93ec-67a2-44af-831c-c04c9f50ceb8", "comment": "Malware payload (MarsStealer)", "value": "85921550e934c32ef990b970c60cf084945e1367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121397, "uuid": "8e6344b2-119c-4f15-b47e-555a055f8c5b", "comment": "Malware payload (MarsStealer)", "value": "3297f4c2995775d564e776c02d1f46685f95169fc7b8e1f9b9a4a8f9db5dfe72dd3e3161ffd7e0ca09715d5e4f043a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121397, "uuid": "68a864ff-699c-49bb-be14-25190d502fba", "value": "T1BEF3F1342479967EDA7C097DD90AE77E72BCAE982DC1280FA0434DD09840B5B1BD5A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121397, "uuid": "0336936d-9573-4c4e-bf9d-b22509c218a4", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121397, "uuid": "d641eba6-fe4f-48c7-b0e9-128da95526a7", "value": "3072:Uw2uLYqhx3F4VIs40k5/T+onALgiS2XMHRe6OhQFkW2JSp8Bb8EG:hssx3Fec/KngiS2XMHRJOhQFkt8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694121397, "uuid": "1e89e706-7f7b-491c-b78b-0d9f42fd5275", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694121397, "uuid": "76cd7efc-14f5-48c2-926d-64a20fc14987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121397, "uuid": "fc083fce-439d-4b6d-ad51-4a3dc22dca5b", "value": "Tutanota.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c976dc-4d90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694099260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099260, "uuid": "6f59469b-1dcf-44f7-9346-55ddb1931c27", "comment": "Malware payload", "value": "0ab994c1381ca1054677d7ff3e142fd3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099260, "uuid": "556b9dc9-a0ed-42d4-9a1c-8110c7476376", "comment": "Malware payload", "value": "69c42646023d753e4fe1709f37c8cd45b518b5af1e58f4b8389c96af1739471e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099260, "uuid": "377720cc-6201-46d3-8fe0-c845f046ffc8", "comment": "Malware payload", "value": "6d230f2d77bd809b872d1eb55b3ff2bd26e7b5e4", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099260, "uuid": "fb1eb4ff-eabe-4b33-a43e-64e62e5194e9", "comment": "Malware payload", "value": "92c2de07f010755fd8bb887238a8a5c6e7b793f12f3c92e2892df073f9fda3d477a1f5eff8cf4cbbd08d37c7b361ad91", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099260, "uuid": "baef7396-2314-445e-a1aa-c1cdf9a434ae", "value": "T1D3D533035AA6AD81D522333BA8D67E3076AD9337FF526B5CC11ACA8B04D0DCBC55C98D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099260, "uuid": "1c6b1b27-1d8f-4f14-ab06-a7076463ff46", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXAU1gT2iYtl6W7:OVtEgPdiERqpWvMOODP31gDKIW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694099260, "uuid": "1af629b9-b1e6-457b-9beb-159d6ab202ad", "value": 2844081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694099260, "uuid": "76356a0e-7adc-4455-87f0-20494ee4ed3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099260, "uuid": "dc8958ef-77e8-4abf-9c67-8375db12138f", "value": "MediaContent.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ea95ea-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694075227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075227, "uuid": "a6175f41-a8f9-486f-9fcc-835fca81d569", "comment": "Malware payload (RedLineStealer)", "value": "d960eaa274f0088f4839581894548a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075227, "uuid": "6901b149-da3b-4d35-9373-b44d14c11977", "comment": "Malware payload (RedLineStealer)", "value": "69d4e7ce2ab31d4f38f2e9b879a25dc217356f75ae617daba3d96cb9c24b03e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075227, "uuid": "01d9f327-5be8-490d-946b-b43231416c74", "comment": "Malware payload (RedLineStealer)", "value": "37e79192c4417a9a1143cc31959fb78bea272867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075227, "uuid": "d2a751ea-1719-4060-80c6-3aaba42bc86b", "comment": "Malware payload (RedLineStealer)", "value": "f5718c288df082a5ae6d00f5135cf5780373c4ae8b9ea534e36112ea5adae66580c471ce5147ff46dfd4ef2004113321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075227, "uuid": "ad2f61ca-45ec-40d2-a818-0b2c733ef08d", "value": "T1AAE41252BBFC8072DCF55B7068FB03935A35BCA19EB5839A274A494B1C725C1963233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075227, "uuid": "88c720ce-5cf5-4943-8749-dbf8814fd8fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075227, "uuid": "9cd46cd0-5809-467a-a0d3-506883875125", "value": "12288:VMrOy90htzTLzIr3ZXMK7b3V36JAOjv+qr4ZYwpULwDdib2o:vyoUZz7b3V36ZmqraLULOUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075227, "uuid": "78954236-c4a6-4eb1-8450-ffeeff2479f6", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075227, "uuid": "91c4341d-8e86-40e2-b66a-2cfe93614f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075227, "uuid": "4f86f8f0-0ab3-4c67-a69d-deb19c3ea623", "value": "d960eaa274f0088f4839581894548a93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a7c16f-4d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694066900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066900, "uuid": "831ad1db-7df0-488c-9ae0-6d920c5998ee", "comment": "Malware payload (Smoke Loader)", "value": "17688f03f125bb494dc7f304b8936221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066900, "uuid": "558a54ea-0a11-4438-bb2e-e43ea059fa44", "comment": "Malware payload (Smoke Loader)", "value": "6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066900, "uuid": "e5fff93c-a2e9-463d-bdb3-472f266cd09c", "comment": "Malware payload (Smoke Loader)", "value": "7fadc66ba11a5b3c4582f4d9b5b245801ccf918a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066900, "uuid": "29e6374a-bd94-4ae7-a4e8-9bbd7a7bc4ba", "comment": "Malware payload (Smoke Loader)", "value": "f7100b9727b26b4b478301d27f40219e3a7b165c316d023020f69f095b16ff598994fa2d2cae6e97ee2f7caa30710f03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066900, "uuid": "8e80ccde-c347-478b-bc26-c57c1ee52817", "value": "T16D059E13BB47D5F1E2892737C5BA140407B1DE82679BDF9B79CAA3A648033BADC42507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066900, "uuid": "abf3d5f9-2fe5-4148-8dd2-f0452e5b1e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066900, "uuid": "bc158f68-15e2-433c-b6c0-0120071a3765", "value": "12288:Ib/bL1cEYZpFQOT4KpMT+msoH985+3wAFn6DQnbu7L3SpiQXYIOnUfvDrD8FEsim:WzLmQsI85mn6DQDYpmv8FEyuOGLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694066900, "uuid": "9333df49-638f-4d14-97cd-9e2008c637d6", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694066900, "uuid": "98a3bfc3-1095-4ad9-bdb1-e9981299821e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066900, "uuid": "d30c5b93-c6e2-4dbb-9a5c-590355d145d6", "value": "17688f03f125bb494dc7f304b8936221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3715c683-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "a99db347-5e9d-46f9-b284-c80281d1d947", "comment": "Malware payload (Mirai)", "value": "9f52d43d7bd066639134bb82acd2baa5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "b6d5d9f2-586c-4b94-ae12-fa9314861527", "comment": "Malware payload (Mirai)", "value": "6a2b5da0179cab854a72ec2331f508dbd896ed9179b7f04c484a3232ea5ff40d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "7c916762-3e9d-4519-8e38-0fc8869ecd2f", "comment": "Malware payload (Mirai)", "value": "8fb3e99aef702f6ad874c821b6042d2e5b22b14e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "d532d174-3c61-4f61-87d0-d4b96254db20", "comment": "Malware payload (Mirai)", "value": "ce46d8a9080a79b46dc8239e6378f397a4ba1e479b2471c2cc13c85efee1f5ee98e7bc7b4b23c07df39553f8363588cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "594bf2fb-7f3f-4a9f-a420-acbef6bb019e", "value": "T133C2F17FB6AA6A67FA5C2339E435811B0394F11C57AE6B5723800532DA5F82E7132CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "3b88d794-15de-41ed-a889-fc3512650901", "value": "384:MB1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHcPnM4e:0MwxdyoEUnDz+Y8tqHWXm8PLays0N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101805, "uuid": "328a2afe-9b85-4afc-8b56-5a9714226502", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101805, "uuid": "4ad28ef3-9e6f-495b-87fb-dd4dad7ce293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "96967aa7-78a7-4ae1-97d7-e1f25ebd13fa", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10444749-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075541, "uuid": "7e636d8f-146d-4ce5-84ce-3c14383fd437", "comment": "Malware payload (ConnectWise)", "value": "8c0f54c336d369a327bc09bb47e7ded0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075541, "uuid": "f57635f0-1370-42b2-9d92-fa2460dcf0c7", "comment": "Malware payload (ConnectWise)", "value": "6a334375241f3a59061b2545dcc4dca45e6bb90aacd2cd9bd6d80c77f4b424d5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075541, "uuid": "a1efd62d-4e04-4234-9d8b-59cdb85dd321", "comment": "Malware payload (ConnectWise)", "value": "8b7fa38701bff7befa41fd3522df94c800f00c5b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075541, "uuid": "0b70bbbe-7e17-408f-8926-9d082fe038c2", "comment": "Malware payload (ConnectWise)", "value": "b9d60445bd4451ed58ffd035b027bb83e670966191cdef89fb4a053a26764d7b4de45a0185bd428065f4bcda8d496087", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075541, "uuid": "8b54dc60-24b6-4319-8040-7d4a2d35d8a0", "value": "T1A3835B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075541, "uuid": "1056e639-4b03-4773-a560-c73f09dbb5d6", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075541, "uuid": "0cc30727-90e4-47d1-abcf-5732aa4c904c", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3KJk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075541, "uuid": "e8fa9301-9c66-4752-b3a9-6205657f2311", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075541, "uuid": "a677ef6f-1b0f-46ad-950f-a019e158f32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075541, "uuid": "c215935b-fc9b-4e42-b85b-0230c845b55c", "value": "8c0f54c336d369a327bc09bb47e7ded0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64a3df4-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096033, "uuid": "78f1698d-0ef2-4b7a-9c10-18c9be7f3e12", "comment": "Malware payload", "value": "0a302ee0e5e2e9cf9e98a6d9297254bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096033, "uuid": "312c5529-5511-439c-97c3-c370497c2283", "comment": "Malware payload", "value": "6acfb089d85e0618fb7fe6e615bc841a0cdf3e8d52dcd725a9333cbeb67a05e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096033, "uuid": "3264a361-7743-4e4f-8432-937e7c49d014", "comment": "Malware payload", "value": "9e6f69786ea5a6afb37d933adedaf98f6dfcac5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096033, "uuid": "6023ad7d-2d2e-46c3-8fb3-5fbc19a2135c", "comment": "Malware payload", "value": "34b2ae210b77a1b7c4474909f3d963a7d50e488c6629b6f34f04d43da58152bd33f89292e84c67cb10497ab8ee68b7ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096033, "uuid": "1a716836-351d-489e-938d-88442273dd5e", "value": "T156236D4037D8C136E6BD4BB4A9F2A2418675D6676A03DA5C2CC814EE1F13FC59603AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096033, "uuid": "3aee10af-95b9-40ed-9c41-9ed61478be1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096033, "uuid": "875cd0a8-9406-4353-b473-89f4564099bf", "value": "768:oq+s3pUtDILNCCa+DiaSxLyjilE8Yb8ge9s/ma25svEgK/JfZVc6KN:oq+AGtQOaSopzbTC15snkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096033, "uuid": "cc8f0c2d-0eb6-4c21-bebf-09851e5db0f6", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096033, "uuid": "6933b3ba-f791-412b-8aab-2f59e832ccd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096033, "uuid": "df20f9cd-9b68-4d76-9962-e2f9745597a2", "value": "decode_723dd9d1dfd7f59eb6699d9f7014cc8534aeee84e09c629e2ba7eff09b43d889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c24510-4d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694089298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089298, "uuid": "37596038-3ad6-48be-8ac4-ad6a36a53de9", "comment": "Malware payload (AgentTesla)", "value": "decc7444283cf2b3adebf9fab359e6d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089298, "uuid": "5a3f1c66-2319-49c5-a79c-791d76363555", "comment": "Malware payload (AgentTesla)", "value": "6b5c18b193e5c49317546f6837d87644a8bf4b4f0ef2042fc732679cdfd04be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089298, "uuid": "3d76fd73-d528-46a1-a829-d79394c0991d", "comment": "Malware payload (AgentTesla)", "value": "45cc59446b7fbf3e7d2f749ace43a158e28e8cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089298, "uuid": "50b31cca-7db4-4f00-adef-aa2a2b51ce22", "comment": "Malware payload (AgentTesla)", "value": "3d88f5b9b333ba502ef9125edc1e2641ad433bbfa8861e0f0bff27c0250e44eb24d10791caa7db32838b8cb3cc33f5c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089298, "uuid": "a2c7bd1d-b407-4a4c-810a-2c9c05e3a746", "value": "T1D605A403BA4789B3C148977AE59B0CBE1374D5817213F71B794E236A48437BA6E4DE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089298, "uuid": "d38b6805-fd97-4629-b2e9-b2878f9fdd2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089298, "uuid": "b1acf255-ec48-4c11-93d5-075973e30bb7", "value": "12288:8q5b8WVbtI7cB34vTMkE03DjFCN61Pe7Hoey41OaKmDB4bbv:pbBDI+IvTMkEE3FaQAoeyfv84b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089298, "uuid": "402f9090-b987-4c16-b7fc-d2e705c8154d", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089298, "uuid": "11f91d2f-4661-4601-bd22-c75130c69dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089298, "uuid": "4b10090d-b3ac-4fbd-af21-11aa29cf954b", "value": "6b5c18b193e5c49317546f6837d87644a8bf4b4f0ef2042fc732679cdfd04be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210992df-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075569, "uuid": "810d8163-44ca-4dc6-960e-712bd4ecee14", "comment": "Malware payload (ConnectWise)", "value": "9ea81082aa7a48846f09796844d8a288", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075569, "uuid": "5395ab43-534e-4f52-a559-fad9c1af13d8", "comment": "Malware payload (ConnectWise)", "value": "6b6a2e6a1f9b155739371d8e5cd50f380a88059f7e64895363d664b6260e1c4b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075569, "uuid": "4576b9fb-06ee-4e2a-80d7-bf56ab5e3d81", "comment": "Malware payload (ConnectWise)", "value": "b17136fc243ff97b0b2161bda86160a94a4809c6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075569, "uuid": "905b06c5-cc98-4769-843a-8db60b7cebda", "comment": "Malware payload (ConnectWise)", "value": "e447bda8b634b1c153c4b4c53b1ccaa5a5aa4d85dd31da7430325f72a663949a4d617a8277666fe259239930da0bd25f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075569, "uuid": "c043cb5d-c0b1-45e2-9b7d-2a93d72ee416", "value": "T117836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075569, "uuid": "ee717528-0e9b-4f10-8751-2970e6811ec3", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075569, "uuid": "c3d08e1f-fbc6-4b65-9196-58f23b67ec64", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Kk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075569, "uuid": "6faa2112-030f-45fb-ae67-9d7eba98fa2c", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075569, "uuid": "f46609b3-ac39-4c56-a7b4-f63eea597a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075569, "uuid": "fa3a899a-875a-48ad-800d-f902458d5f9c", "value": "9ea81082aa7a48846f09796844d8a288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83546332-4d3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694064138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064138, "uuid": "d1e503b2-0573-417e-98b2-478a016fc019", "comment": "Malware payload (DCRat)", "value": "ab64344a4338490155d229471ec5061c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064138, "uuid": "6c124d94-11dc-49c2-a0aa-6c9daad37eec", "comment": "Malware payload (DCRat)", "value": "6bf903fb24afd4cbaeefb47086450445d6f5a1c1dc7b229700ca0d610145277f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064138, "uuid": "1153aac0-8a4a-44db-99e3-d921819ec6f8", "comment": "Malware payload (DCRat)", "value": "3071023035afbc8b2205d2023e1d9a1604bbe2e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064138, "uuid": "fcf64eb3-5ab5-4b6e-ac50-e2be4baa73b1", "comment": "Malware payload (DCRat)", "value": "622491ea1dfa9ae7cbfa3f6297aa396eaddf268f08ddbc071428eb8c3c1eff18808eea20201f5d255fca2153ccfba8c1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064138, "uuid": "1dfbf81b-f6c6-43c4-ac6d-17b8ba6902db", "value": "T11CB5AE69EB4310B5D42757B0C19EDB3A8A25BC188532AE3FFF6BFA44B4332123E55152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064138, "uuid": "e496ffd7-84e0-48d4-af94-6125b90a6fd0", "value": "cfa46b685380119100ae69003aab82c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064138, "uuid": "23331217-a068-41e9-9945-5351383f83a7", "value": "49152:WN8FdC/k2+jzAZWPvVx7XjSEGisa2JR7EgZrti6gBZ:Wo5XLPvXKEx2MgZrCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694064138, "uuid": "004afa90-0e43-4840-ba77-f6fb2de3371b", "value": 2293512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694064138, "uuid": "80d470a0-5b14-49bf-8c65-73bbd9217879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064138, "uuid": "15c783a8-7a15-44c4-9620-8998fed939ef", "value": "ab64344a4338490155d229471ec5061c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8385f515-4dc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694123409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123409, "uuid": "e354a08d-6550-4a4b-8345-6ceeaa9f7140", "comment": "Malware payload (Mirai)", "value": "8885c08c7cc5994364a661ce173965c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123409, "uuid": "65898294-8330-423b-83de-3f625fab64d2", "comment": "Malware payload (Mirai)", "value": "6bfc351432261940bae7409917ad720a9fc3440a5b0721c9832cb6644576c3bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123409, "uuid": "ad0b5858-3c2a-454f-8f7c-2c80f3dff09a", "comment": "Malware payload (Mirai)", "value": "b2be20419d8ff7af4f9b7a923dbe9a121d96ab02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123409, "uuid": "35b820f5-85b5-41fc-aae8-113514c3a6fc", "comment": "Malware payload (Mirai)", "value": "f6992993b311e19b0e402c3cdb3b3e4cf880950e99b4260630ff61a68ebef9f5dbe719bd1dae648ea6914c24b5ac3be9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123409, "uuid": "52fc4d72-7132-4740-a346-45b63851370f", "value": "T122C32B46EA408B13C5D617B7FAAF41453322DB5493DB730689285FF43F87A9E0E27A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123409, "uuid": "63493ade-4358-4f78-a403-6c4f6e50b8c6", "value": "3072:K8PXmy9MprJXM93N30yDShgFKeqBk+nbHM/9trM/:pPXmy9MQb0yDShg4eZ+nzM/9trM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694123409, "uuid": "e41f4d3e-f113-4024-aac3-a526cf3ae155", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694123409, "uuid": "858cf091-1fb7-4007-8a44-d1c48b8057be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123409, "uuid": "d3f3557b-7915-4292-b600-c2d067f34354", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05678a2a-4d6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694083254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083254, "uuid": "caafc4ef-2637-4d09-a15f-f4d0bf330501", "comment": "Malware payload", "value": "7b3df1e9c4fe21df179c81f8c56e4e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083254, "uuid": "94e1c7b9-bc15-4437-982c-e59d1ce7a480", "comment": "Malware payload", "value": "6c1babee08c72df835f475cd45df16bb153b32ec55edd018f152d115de822141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083254, "uuid": "e11b8967-605e-43d7-8c7d-ff517d0210f2", "comment": "Malware payload", "value": "dba42f134fdd1206606b57e578baebd20cf024e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083254, "uuid": "d45b7954-1ad6-433c-9b30-5a13a5b8425c", "comment": "Malware payload", "value": "73cb474b8d8d86ee4d606262292a5ae8acd49b553472960fe96fac9331ad8a57cd94cddbc981029342d45d1f4b4f9a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083254, "uuid": "af783d27-5317-4fb9-b6d4-b6dee327be58", "value": "T19DA46C00F641A335DC0942FA87EBE17926BA79B647398DD3F781CE1695364F1363EA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083254, "uuid": "e3876c73-a91e-487f-90f4-bed24619c3e6", "value": "ee24d76aaa9cda07f415ae0d0ddb3ab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083254, "uuid": "bc281c79-4d34-4f90-a18c-5dc2f01056f7", "value": "6144:hL1INZ9cgANin8BwvY6UuciDudCXaPM19ZqT6c3KOtR4wBa5oi90:hL1xNi8B0Y6UXAXaPIW6EBtda5od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083254, "uuid": "82615f39-f69f-4141-bcc5-d906128a6eaa", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083254, "uuid": "21cad4a0-a074-4e57-baa6-b8646e42dc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083254, "uuid": "33060fbb-284c-405c-831b-1e5e81abaea4", "value": "6c1babee08c72df835f475cd45df16bb153b32ec55edd018f152d115de822141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6b3eb3-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069095, "uuid": "363f62cd-d142-4141-9d2b-4fa0cca1ff20", "comment": "Malware payload (AgentTesla)", "value": "0c1978dbdd64f7376f63209471fa0022", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069095, "uuid": "60de1d53-69b4-4edb-b86a-77cebffd4e3e", "comment": "Malware payload (AgentTesla)", "value": "6c94ae6e530be4e802f99837dbf48903a48b91ace2e42fd95c1dd2ebb0e82a16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069095, "uuid": "ee981710-1c21-4fc6-bf11-e5b0aabc8164", "comment": "Malware payload (AgentTesla)", "value": "3ab80f637c3d5f16aece3d6ed7f47a35898d0777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069095, "uuid": "fbc3777f-ff37-4273-b3fc-cdf76ac37857", "comment": "Malware payload (AgentTesla)", "value": "3442ad44871c66f3244b381d05f55f548b0d91dd56f78f00e91f2cd62d31e3c475570da944996fef53d82732eab55587", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069095, "uuid": "5933aeac-e2b8-4bf6-8c50-55ef1282513d", "value": "T101D4010873A84B26C57D67F1D491917483362919A8B3DE398DD222D730E27A70E17EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069095, "uuid": "814717fc-a6b6-4348-8f7c-b3829ca5439a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069095, "uuid": "0addccde-77a3-4488-ad53-3a0d113c02bb", "value": "12288:P3o2iNHkDwMD8umtGL8fAv8S2mVK4HX8HDo8Y2qFvb/eD1OlX0VVn23:P3o1RkDV8umwYfAv8S9KqX8Hk8Y2qF+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069095, "uuid": "64f0d44d-c9a7-44e6-be67-06d6af578f6c", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069095, "uuid": "e82954d1-90d2-42c7-979d-e22ff43825dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069095, "uuid": "85b88778-fd5a-4010-8b9f-92e3154a953a", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e5ebb6-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075203, "uuid": "0c96122a-2f83-471d-a4e0-000b0d290b08", "comment": "Malware payload (ConnectWise)", "value": "70b15164335801aff3d49c8b24ad20e2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075203, "uuid": "ffeab0e7-5955-48e5-b856-d252ae3a89fa", "comment": "Malware payload (ConnectWise)", "value": "6cae53429303d83b6996b7e97fef6c3f4c45fd666ff0bd67f146b869eb660599", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075203, "uuid": "89d24ddd-0d6d-4ff0-81de-ebb5bd2b9ebb", "comment": "Malware payload (ConnectWise)", "value": "a2868b87ba193054aeef8a74cbd07dc9ac3232f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075203, "uuid": "1a1ad3dd-4dea-4859-bfb9-7e99807b5bbf", "comment": "Malware payload (ConnectWise)", "value": "868654164ea28c80f109383731e07b360d753ad4032de32095c77b2697634f8422a56c6d8ae340d5338d33438b482cb4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075203, "uuid": "cfc0e0c1-60b3-43bb-b7b7-e9d9eaddc38b", "value": "T10116D011B3E582B5D0BB0638D87952669B74BC084356C7AF97D4BE692D73BC08E22373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075203, "uuid": "647afdba-a8b9-4432-b9a2-577e669bb361", "value": "96e03c6bfe932500a28aba3c63f5c7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075203, "uuid": "4ab6a1ec-3aa8-4051-a460-d2f89992d1e1", "value": "49152:6cXSUX/mi963PSumT0+TFiH7efPKXeyqkXSPkYYb1rSuRlUaXGHpYLgSL1g0nt:6HOj6+6efPiSPkYYb1rSuE+GJY0gbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075203, "uuid": "9a3b4fcd-12b2-46b6-abfa-e84b902b45c6", "value": 4152528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075203, "uuid": "cdfe8628-8d47-43c1-ac63-0853d4608b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075203, "uuid": "9722e36b-63b0-43a4-9a29-d5b04b5dcaaa", "value": "70b15164335801aff3d49c8b24ad20e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7c904-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096049, "uuid": "0270a005-5ff7-4586-a73b-621f7fdaddd4", "comment": "Malware payload", "value": "267a150aab187d887c951969604f2403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096049, "uuid": "119b4887-083a-4cb1-9138-85f4e02c431b", "comment": "Malware payload", "value": "6cd4425e6889e91b90c3d3f786e890b27678c5379b52cc12649c6d79111fbc71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096049, "uuid": "52a03dc6-e88e-4ba2-aae0-4bf72bdc948f", "comment": "Malware payload", "value": "3d191bd40071816ae98bc7f95d8e8b14cb8be8a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096049, "uuid": "ae1ccdb7-d495-4670-99d4-a51d9c4ffef1", "comment": "Malware payload", "value": "c26151ae79275e523216949847722faf6c3dcb9cea3a9a674ae5a5144ee89997566add31f4302e49627fb9dd55c2a476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096049, "uuid": "2caeea3c-3c21-4ae8-8155-864f2064918d", "value": "T102235C003798C136F6FD5BB5ACF2A2458675D62B2A03DB5D6CC811AA1B03FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096049, "uuid": "3aa0a9fe-63c3-4874-829c-33f602fe0163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096049, "uuid": "147c4a02-2d36-4946-8a80-c1d026df182d", "value": "768:99umxLiIL1CaS+DiP9PfDOBLe0wbijycYbrgedF84lvEgK/J7ZVc6KN:99uAPWlPfILdyTbUkF84lnkJ7ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096049, "uuid": "11bc9779-7b81-4e9f-9b5c-e4bd85225bb0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096049, "uuid": "c2ec49a4-8ecb-4cfd-b2ed-eb0b9bab020b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096049, "uuid": "189b1575-d8f2-4c19-bc03-ea499b5a749d", "value": "decode_df12963d022970f1891b7852e721cccbbea0c4b0b55687dd571ea6404b3b6cfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0b64f-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103258, "uuid": "b605f08f-b504-43ea-adce-7bc4e44f05c6", "comment": "Malware payload (AgentTesla)", "value": "966c16533d21a1cf4f05faec8d9fda20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103258, "uuid": "ece94fe2-3210-4cd6-8cfd-a90e8a3a5df5", "comment": "Malware payload (AgentTesla)", "value": "6d304e636be69bafcfae9423e629770fe3499d352e2a2259b9dc8f428b9e7cbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103258, "uuid": "45eae1e8-db53-440c-b902-7e21507b67c2", "comment": "Malware payload (AgentTesla)", "value": "6d3c53cc9356464cfbc8f99d39c135aeeb3a05a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103258, "uuid": "9b6e0da7-52ed-44a5-9870-68e8299223c1", "comment": "Malware payload (AgentTesla)", "value": "869bbae2879b75d22e2b3b01177391908c6da81b207d690ba26a833490e09ed422403c6aac92e2c6102a7e5a521eb8ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103258, "uuid": "d8f63061-3968-4523-96c4-114857213aee", "value": "T143C4DFF9646AC7E2D3B463FF926760349A67BC10247042CD377C36804DEAAD35926DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103258, "uuid": "d47ad980-59b4-4615-956a-de9e5a514062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103258, "uuid": "f05bbf70-9a2a-4a9c-921d-49d5066098c3", "value": "12288:H5fVsbR22942R08zq3J+NL4hnVRED6Rm8PtXziM0le:HtO2U422ckJ+NQnVCDmmyXv0le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103258, "uuid": "39b1cc8b-9660-419f-9cda-06594db9ab0e", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103258, "uuid": "0f20e47e-3c66-445b-9616-3b57ca97490a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103258, "uuid": "cf042a6e-f2a0-4628-86b3-6cd28e559182", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca02bbbc-4d24-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694053089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053089, "uuid": "c82762dc-65b5-48b5-84f9-57ed695ac2d8", "comment": "Malware payload (MarsStealer)", "value": "33a94e83c13f311afb4737f42e408bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053089, "uuid": "f15c9ad7-613b-469a-9832-5162d071d39c", "comment": "Malware payload (MarsStealer)", "value": "6ee580c8d6b8e197a80fb8b72813005d1283b968bd6f63963fcedbe874fe57c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053089, "uuid": "62e3efdf-264f-481b-b022-9cf11eac97a5", "comment": "Malware payload (MarsStealer)", "value": "a4446416055ed0441f9dac792817cfcdd937bb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053089, "uuid": "7c308362-5bc0-44f8-97df-9e1396db0923", "comment": "Malware payload (MarsStealer)", "value": "ffa247faf9365608e80d228c53f7adc8652fd3a0a46b1a2a8d55f8a67d1992eb2372c7c56dade49b7d4f414382df2e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053089, "uuid": "5ae3a159-1d26-497d-a55d-c8775160d41e", "value": "T16454AD22B6D2C032E16329384A71C7B54B3BBCB29F6156CF77943A2E5E716C18A35707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053089, "uuid": "2fdb3509-06a0-4a0b-8f5c-623c8681f3b8", "value": "d5b70e22276decc41f732fe8162e7fe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053089, "uuid": "2776a1d3-f046-42e0-a8c5-9905a13f20dc", "value": "6144:gnoZ+sQs2LRJTuq9REi0MCkTRUXgkH96:jmLRYqLEiekY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694053089, "uuid": "e1a5aa44-fd97-4562-bdcc-7f3f7c6c7aa0", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694053089, "uuid": "5b16869a-65a9-4761-81bb-af4e6bd0c9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053089, "uuid": "1a56bf68-e9dc-4216-8267-2b001dcab783", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056bff6d-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075523, "uuid": "38f19fda-9c37-42ed-86a4-b6f7445b53ce", "comment": "Malware payload (ConnectWise)", "value": "6b6d9bcf36c7c92962918529677544c7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075523, "uuid": "ec9d943f-6c53-48d8-be55-ab1a6c37e224", "comment": "Malware payload (ConnectWise)", "value": "6f6208b13264a984058880d235dfaf484eafc847518a033e07df8d84edea520c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075523, "uuid": "07d3a2d0-396e-4511-9f96-4f1bfbd975b9", "comment": "Malware payload (ConnectWise)", "value": "46ee5d1b3dd739c37ecb78b95d82138de2e9214c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075523, "uuid": "7b2d2403-2733-420f-b625-6706f34bebf8", "comment": "Malware payload (ConnectWise)", "value": "a8030a4e02d185adb9b4dc14d6c3e3ceb96b91d4131a4e410cb785d1ad0bd3c11d34f4a8fce8e62f0e72d84d7fd0128a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075523, "uuid": "e17f9558-51af-451f-8f58-37004eab4f45", "value": "T1C8836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075523, "uuid": "6a2e934d-dca7-451a-b623-477084ecac7c", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075523, "uuid": "35f7a9dc-aae8-49d8-8ae6-7008c739e32a", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3tk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075523, "uuid": "80c36167-9bc0-4425-bc7e-8a391120a8d9", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075523, "uuid": "739b945e-4771-4e7b-8363-e5fde3a2baf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075523, "uuid": "8c12bc0d-2c31-40b2-b5d8-64c4dec24a9b", "value": "6b6d9bcf36c7c92962918529677544c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5063150-4d51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694072489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072489, "uuid": "43566224-7d3c-44c7-b0d1-f4c57b3b3e20", "comment": "Malware payload (Amadey)", "value": "bf9a9955ae74aea59296c9f33437aa0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072489, "uuid": "2c69509d-dad3-4b93-b2ff-d11de0b8bdd4", "comment": "Malware payload (Amadey)", "value": "701f88440a1c4785c6c54f2d1a3b96c2653a170bc83e1b745b01960491464ee1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072489, "uuid": "f7e6a178-343b-408e-8ee7-533deab25fe6", "comment": "Malware payload (Amadey)", "value": "cae54fdeb4b4c8df89a4873a4154a27a8d61c3c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694072489, "uuid": "a15229bc-5e00-45e6-a412-46300aa75f06", "comment": "Malware payload (Amadey)", "value": "14747a69ec3c082451f96944e9d41c7955221ea214be846d9df1731944491177a19239d7c9d34829f1169805007f6a2f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072489, "uuid": "70efdc30-261a-4219-8488-15cea2568664", "value": "T14A24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072489, "uuid": "c4c33ad2-c73a-4af6-a901-2a274e5f0f4c", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072489, "uuid": "78e757fc-2020-405d-8d3d-51b7492b7a2f", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694072489, "uuid": "000221eb-71d4-4c0a-a167-9d2f875243bb", "value": 225888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694072489, "uuid": "bd9ac528-8202-4cc4-a1ca-0ae59a54b3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694072489, "uuid": "ed1528b7-d01d-4605-a367-3616c22dca82", "value": "bf9a9955ae74aea59296c9f33437aa0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b346274-4db1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694113570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113570, "uuid": "0401c61b-d3af-4109-b7c4-2b771fe7ac00", "comment": "Malware payload (Mirai)", "value": "0123b304b50e9f11e1f4aa3539ff0eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113570, "uuid": "819eaed1-5ee4-480b-a91b-3f9a163424fd", "comment": "Malware payload (Mirai)", "value": "7064784f314745cf476ee06c5a36cc87c3f00dd1c563ce33f7d56af3470de970", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113570, "uuid": "d80cf16c-ca11-46af-83fc-1a5d8d683c22", "comment": "Malware payload (Mirai)", "value": "5d6609b59338b4cc61bf7e034693090364694a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113570, "uuid": "aab6a886-5f11-4c34-89ce-75eaed57ff81", "comment": "Malware payload (Mirai)", "value": "dbb2b671d0d7c705959d7f5bb2512ab9b809b716d20bf8887520616817679655a6f9ff4db2bcf7e772e6be2359db2858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113570, "uuid": "29c75eb2-81ae-4882-a66c-37f0e699b2ce", "value": "T1EE639CB2C9642E18D3598AB1F124CF358363A504A2972FFE9166C76DA483EDCF5183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113570, "uuid": "559c672f-d829-4363-8b1e-cc3b337ec29c", "value": "1536:E6ICOnrFO8lRO6xMmw899iwa9rDmCreMMAKw1cUu8NJ:XAwCO6xMCQ9rDmVHwcsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694113570, "uuid": "e7cc048a-1297-4b2c-b7a7-3e077ce4c05f", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694113570, "uuid": "3b911226-cc64-42bb-bc86-ba6d9e4e4fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113570, "uuid": "5acb3856-624f-477a-80d9-f71c844f2338", "value": "0123b304b50e9f11e1f4aa3539ff0eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa9236b-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075594, "uuid": "5b67f71a-c545-4d14-a937-a2e47409cb04", "comment": "Malware payload (ConnectWise)", "value": "49b7f51193c894f011db6a78fda56ba4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075594, "uuid": "b9116ee6-570e-45d2-9441-2385b13e0f23", "comment": "Malware payload (ConnectWise)", "value": "708777ae1a4832003ab324c22425b2814f0374503989a9eed9080b2da430a7fd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075594, "uuid": "b3a2b9ba-a79e-443e-bcb1-a7eecb9d0abb", "comment": "Malware payload (ConnectWise)", "value": "56244b654841bfb31c0b18e40f7bf00cf9d3ec37", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075594, "uuid": "558bb0d2-e506-4737-bd1f-b3dcc79c46f5", "comment": "Malware payload (ConnectWise)", "value": "34087dcaa7e99cf5f50a72c2190ceb1652f25ad3a65a7745afc02d573f36e1a6a8525848357dcbae9bf15df9f7b73838", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075594, "uuid": "06e59bc5-0041-41fd-9d1e-a4af22902aad", "value": "T18F836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075594, "uuid": "bc92e29b-48cd-4226-a8ca-3505a6b5b60e", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075594, "uuid": "c17d929a-e46a-4fea-8038-ef708774399d", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3ck:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075594, "uuid": "e2a724df-43de-4906-a9bf-756efc2eafa3", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075594, "uuid": "0999d14c-059c-4f18-bc37-754b9f264d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075594, "uuid": "bf8d3e13-c1f4-411e-9429-b9fe976d549d", "value": "49b7f51193c894f011db6a78fda56ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a595c1-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127866, "uuid": "0fdc9c75-97d6-4918-a9dc-516864b8b3e6", "comment": "Malware payload", "value": "f2edb0363e3d4a3f02bad2671b508410", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127866, "uuid": "3301009a-bbb2-4218-98c9-716a9747b811", "comment": "Malware payload", "value": "709c76d17fe600b627319be49acfccc06fb2963e73e89a7d37de7731624b959a", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127866, "uuid": "f59e820b-e136-4a9a-a8e6-4efa2f01ff11", "comment": "Malware payload", "value": "947b076a364bd0cc43480451e543cda96d12fd87", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127866, "uuid": "05222f0e-1206-43e8-9142-9854b00ac83d", "comment": "Malware payload", "value": "e87022e924774c707f3ee1ae8d914b5c6e7d5dc9ccff36faf560096598e0a68dbd0fccd38a04c55ba130c1ee257bb3ff", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127866, "uuid": "b7b1ee48-237b-4236-862b-fff16521a81e", "value": "T10EA533D65A535946D32142FD300418AD9F3500B33591E0B332B2EF6FB4E866736EA6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127866, "uuid": "ee8df4fc-b219-4ba9-820a-aa48d3b1daf7", "value": "49152:GffoJMTUnjw/SSJvVQHSItn8SAU8b7EJyURfQfP4LEUYH1azpXt63XhWs:Gff4MTujw/Si9+V8SsESfP4/vVXA3XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127866, "uuid": "423cabd8-0cbf-46e2-8481-3d3285d7b44e", "value": 2251939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127866, "uuid": "a9db9941-d418-49ba-b2c5-cd09dd3ad22b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127866, "uuid": "9d05211c-1c2b-40bd-af7c-eda96339190f", "value": "LocalEditor.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98989e97-4d9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694105405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105405, "uuid": "127e76d9-0d6d-468f-a113-a892a8fe5142", "comment": "Malware payload (Mirai)", "value": "5d45cd825a86ab8fa4e950afcab5cb1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105405, "uuid": "720f045d-6be4-4894-a456-46a2f85d4c25", "comment": "Malware payload (Mirai)", "value": "7173c4111ad0e907845753384b460baf67b655fe9db67b85ee35ca7240cdd7ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105405, "uuid": "5b57a765-d5a0-48c8-a1ff-d607218afa80", "comment": "Malware payload (Mirai)", "value": "af0f29dd86e3472f47a5c7bc2c92d4fc6e3b76e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105405, "uuid": "7db228cb-0f72-42a3-8f50-d22a0979a5be", "comment": "Malware payload (Mirai)", "value": "e8a36108ab13c0ec1066bdd1c9ff48a8fa1fc6e31959cfc7e0bfcab165d1b9db342bead81baea3b0940ba76484007061", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105405, "uuid": "8ec6c4ed-6d93-44e6-88c2-f4986188ac38", "value": "T1A0E35C46EA818F03C0D62775BAAF424933239B54E3DB73068D28AFB43F8769D4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105405, "uuid": "8b82eb5b-e6d5-42ee-9cbc-a124f36086e3", "value": "3072:fVamN2SjEaphKaaVkg2uc4nDfPzBMFXX8gIM/9SuCYyf:f8m9jpeaaVkg2uxnDVCXX8vM/9SuCYyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694105405, "uuid": "baa529fd-c551-4ec6-8162-9b8c86a9e48c", "value": 152743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694105405, "uuid": "01cf2c39-c8ea-4217-9fbe-799e2d5eff62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105405, "uuid": "2d971193-55bd-4a07-a5ba-75cb0160229b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048abf52-4d48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phobos)", "timestamp": 1694068220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068220, "uuid": "0ee9ec31-22d9-4411-99f0-875438410253", "comment": "Malware payload (Phobos)", "value": "cb0f99306d05042b8b3db064ac3489b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068220, "uuid": "b55c7664-03b2-4e86-bedb-cbe4f5fa8673", "comment": "Malware payload (Phobos)", "value": "71bd706cc0ace3774449282a9c1de5403f8f43dad118b9fbf4fc45cf4894f8e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068220, "uuid": "2f726d10-2d53-4c1c-87f5-4a8fd8325309", "comment": "Malware payload (Phobos)", "value": "1a5e8b4435f97dfd09b764c82dba35868e792803", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068220, "uuid": "4318e881-32fe-4aac-a0e6-98c25315828f", "comment": "Malware payload (Phobos)", "value": "5a4d74fc64f65c23cfa488e75c02169ee74c6b9d8c22563f8b8acd302d048549afcbb609a5314bc752a69e1a7e23dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068220, "uuid": "c84f41af-6897-428e-a4b0-0be283b2eac2", "value": "T168D45B53B7A7C9F2E2C81736C29B150C13B5C582E7AFDB0A798E239658437A6DC4118F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068220, "uuid": "fa45dd5b-a22d-4f59-9620-e1f5da56bf12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068220, "uuid": "df841be6-739f-4198-9819-c353de6d28a6", "value": "12288:nOifrg3Pq0mw2Jgc75Tn9hTMK6OHjuy+X4SsDca7nF7Z30G:A3sw2JjyK6zy+Xv8nF7ZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068220, "uuid": "28255b0d-14f4-48dd-91c7-da1c17770f94", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068220, "uuid": "96344663-4c9d-4e2a-9aea-ba79a77f0cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068220, "uuid": "d507862d-ab1b-4241-8ddd-42dc3e4c3e06", "value": "cb0f99306d05042b8b3db064ac3489b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d175f11-4d45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694067134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067134, "uuid": "8a6e9813-47dc-4fba-bbe5-e160e75946cf", "comment": "Malware payload (Loki)", "value": "17f541a997fb45174a5919bdb245e89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067134, "uuid": "76909dcd-2190-4366-ac96-cf8d24ed9507", "comment": "Malware payload (Loki)", "value": "71e6c707a1cf5d6a1005480a5fd36d7c0dafed72ad276d396c8c3a09f086ccd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067134, "uuid": "1e25a1b0-f009-4092-a5f1-d94b3fb20a11", "comment": "Malware payload (Loki)", "value": "b2fa2fb586ca774b5e53a20b0e3eced6fac93529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067134, "uuid": "b1a1c903-8023-4816-910d-4cf3c7977f49", "comment": "Malware payload (Loki)", "value": "e578031c81b8f72b849928e024bc64bd8ef721e8d91d197f95090317c2e2011bda09cd5ebc3d90fab0e2ac6403c3e8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067134, "uuid": "40523f8c-1871-4477-99be-dbd7252f1399", "value": "T1AC44CF2273D2C033E26305745AB1C7B59E7BB8721B7195CFABE41A3D1E386C18A7435A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067134, "uuid": "6c7c7f33-903d-4f92-a112-189c681da080", "value": "4905c16b56c6c2dde9b3bf949bc04295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067134, "uuid": "4de4f087-3867-4365-a91a-6c830a40d0d8", "value": "3072:jEop+gPpqYriMDw01q3GWGm9HDSd6fdPKUsUvQNi94Hi5lbKFtb14:gop+gDBD1q3vGSjQiKUTQEGHCYFtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067134, "uuid": "f5f2847e-3b2f-4911-b968-8da8d04aef1e", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067134, "uuid": "18ed8d59-f49a-4955-ae7e-489a84d529ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067134, "uuid": "6c070b2a-b509-4a21-8efb-56096943fff6", "value": "SongHong BankSlip+Statement.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8605d03-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694083125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083125, "uuid": "00e74d04-76b3-41f3-b0cc-9f5c8604f43d", "comment": "Malware payload (RemcosRAT)", "value": "63c1ad589de5a285e91c52a243b2b9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083125, "uuid": "3ff36d9f-2125-487d-946d-aae775c0eb7f", "comment": "Malware payload (RemcosRAT)", "value": "7231c553f8e0564923177725ac2c747e54c9c35c951f44abead4859f8083d692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083125, "uuid": "04a3d77f-117d-42d6-9009-0b75c8d618de", "comment": "Malware payload (RemcosRAT)", "value": "7f5b29fbec118fcc7a4064bbd34026b6957135fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083125, "uuid": "abaf4a7f-9393-47ca-bdf6-aee7b6b86132", "comment": "Malware payload (RemcosRAT)", "value": "4c00fb2a4580999b6b6488a0d1e3c2c47d9c0b7743b8b4522f98267c00d9f5243d1641a513313cc3a0779f8d6d498743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083125, "uuid": "cac8f00e-02cb-4da5-8aa9-a27bb4714580", "value": "T13A356D11A2749865E069B9B6C809E793F8AB3ED0ED4F4CCD90AE79F91973B90351C04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083125, "uuid": "7c1861fe-32d7-4901-b321-f82aa245033b", "value": "ad2271d934650237c138775ff423f68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083125, "uuid": "f94920d6-ea85-4539-b44e-16392beb7e0b", "value": "24576:aMf7L4HFRk6LgYTYkOZ8qJ0sJYGi1t2WnVwhw:a520", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083125, "uuid": "f5e190e8-4c1b-441b-8ff8-67f1df3c74b5", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083125, "uuid": "90e9cb69-e8d8-45ad-80aa-ca7deec79ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083125, "uuid": "0d9294d6-8b6e-4469-a9c5-c7bb4d07f38c", "value": "SecuriteInfo.com.Variant.Jaik.174388.26195.19254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaaf4c5-4d7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092255, "uuid": "dd40781c-1471-4b47-9270-b671a762aed3", "comment": "Malware payload (AgentTesla)", "value": "25a84733a5943c806ec741017dcb9c39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092255, "uuid": "ec730c9c-326b-4cd2-8f83-e25bf3f0b1f1", "comment": "Malware payload (AgentTesla)", "value": "73d782dc28a38a6e4ee9680f3caee329106a4927433cb0b39837a6ab078f4065", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092255, "uuid": "97b32df4-e98d-48f2-a766-764c944bd27f", "comment": "Malware payload (AgentTesla)", "value": "039e2857ea1b2ed2d4d4ee735760b29a3eeecec6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092255, "uuid": "8bda5384-1725-40b8-bac1-437f51eab136", "comment": "Malware payload (AgentTesla)", "value": "9e2bb091ba3077986297e0c2ae46fc5008b152eb00cfab6eb708602527c024650786962bafdcfec3069ef5f2607400c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092255, "uuid": "c90e1058-7ae1-4f76-82d2-0156ceb11a3e", "value": "T1C0341F177E44EB15D6A83D37C6DF2C6813F2A0C716338A0B6F48AFA529412436D6E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092255, "uuid": "ba3da56f-0a0b-45a8-893f-51e8d2a531ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092255, "uuid": "ec0bbed5-27d9-4a12-a7b2-0a681f108ce3", "value": "1536:LfRvcVWmjzKf9TEOFRkKvyBbNjwWnyOFhV/dvSv8mx0hp+smCa4TmDYyrtrAgTTv:LCAmkpFRkzTnFZA8mxU6MTmMyxAej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092255, "uuid": "a71d0116-74be-471b-bd48-e1ec3f4c09c9", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092255, "uuid": "1ee31343-8102-4e31-af61-cd196305adbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092255, "uuid": "ff4aa333-74bb-4068-b8c5-9cc6a252abd4", "value": "73d782dc28a38a6e4ee9680f3caee329106a4927433cb0b39837a6ab078f4065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3709f91a-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "fe9944ed-73c3-4c4e-a70b-91a25b264372", "comment": "Malware payload (Mirai)", "value": "b8fab7a076fe6b7d51885947dfa89cb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "d388ac9c-4bbb-4399-a1e9-dbb5434415a8", "comment": "Malware payload (Mirai)", "value": "74009fccf64c5844af5313d42616d21d08a33b11bd5cd74104d8750ac7017656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "bae64ba5-e64d-4d89-a059-dc148d1ab4ed", "comment": "Malware payload (Mirai)", "value": "45845ff1b8d0d240dfa59819953012a2728138f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101805, "uuid": "a1a116b7-2e16-4f61-935d-93bb5a7f8f38", "comment": "Malware payload (Mirai)", "value": "9b048494695083e1459c20ba80606d67cdd35306d8a1a70e8f95d68d8e5b0fed51a24fcc5badb783ea81365fecd33bbc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "334d7ea9-837d-488b-9c57-736d56918fb5", "value": "T131C2E2E285FBC607DC63437D29381963A0641C58E74DDE3D1B27DA9C13884E72ABAC83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "18b8787b-85f9-4823-ac22-5e7f5d83739f", "value": "384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcH:X5+Kcrb9VDJef5Q2PdHuzb8HoEPbGhs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101805, "uuid": "9f224db5-4e72-434a-a71a-5e256e4b2add", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101805, "uuid": "56399215-cb66-4b17-a99f-889655715dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101805, "uuid": "e6e4341c-8492-4548-9419-100c59f5bbec", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214c348e-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075140, "uuid": "4a8af672-1bc2-4edc-8372-5df1f31f6303", "comment": "Malware payload (ConnectWise)", "value": "3840e535f2dd406701b0f52280be69a5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075140, "uuid": "87b19db5-575b-4846-af29-a294da97f870", "comment": "Malware payload (ConnectWise)", "value": "74657366dd7d4c8cfb1580cc19033837d5e3b91cf4e77a111720c01e8fbca489", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075140, "uuid": "ceeda19e-0399-42a0-9c5c-d3bf321e6059", "comment": "Malware payload (ConnectWise)", "value": "3f8b9931b04e55b6fba127030a75c4a1b91b4164", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075140, "uuid": "9d1c5199-c00d-4bff-b64c-dbb254c80295", "comment": "Malware payload (ConnectWise)", "value": "dc350a4883c9667f3180ab408aa6044271397968a7ba0ea78b06e3193194c8d1f7746aac103bd8bb70e1e3c575ef28b5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075140, "uuid": "7c0c164a-4b29-42f8-ae9c-10263e8e1161", "value": "T1C746F111B3D591B6D07F0638D8794666AB74BC088322CB5F5394BE697D33BC09E223B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075140, "uuid": "b2abc05e-0797-4ffe-8431-31a31d0ca3cc", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075140, "uuid": "5b97accf-76c1-4637-afa6-dc43506fd539", "value": "98304:qaeNO66+6efPPw2Ks9fM8dYdstG1l40Mprh:qa9efPu8nk40Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075140, "uuid": "3926928f-2e58-497e-ae98-cc9f86eb1b31", "value": 5385480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075140, "uuid": "19b34097-534f-422a-808b-0371ce447adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075140, "uuid": "a681c56a-9075-44d5-beee-8dc30bc3bed7", "value": "3840e535f2dd406701b0f52280be69a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdbbcc3-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069145, "uuid": "9575089b-aabf-4a1a-befc-55364f8df54b", "comment": "Malware payload (AgentTesla)", "value": "c7bd1de1f231ca867f35d645d92c587e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069145, "uuid": "653d99f1-a819-4681-934a-41eaa1bd6a8b", "comment": "Malware payload (AgentTesla)", "value": "746a52210f0e6b3a28112894f604673c11c053b744075656d46141f98d06133a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069145, "uuid": "8ef2c8f5-a026-4713-90e5-5bd1badf9b88", "comment": "Malware payload (AgentTesla)", "value": "6d2d2df2a433e67017237b5f9aed2227bbab54b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069145, "uuid": "6750365e-a19b-44e0-acb4-bb10f6216c03", "comment": "Malware payload (AgentTesla)", "value": "56d428c47000f533b09e0551d629748434600795412414b5616d24078c35836ac85fe6ba6da4581c5e79affb93cadd08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069145, "uuid": "6ab6aff6-4308-4ab5-bdd6-e5c7e1884e5b", "value": "T133A42342FD10FABBC5920A743DB52691FB78808C68F014573B183EADBE05CDA566F25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069145, "uuid": "9ea550ba-6b27-422d-a078-9c805e94cba6", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069145, "uuid": "7ddb6212-85fe-41d4-9f2e-7ea2a3126c0e", "value": "12288:30JI+8FhzcW96cp8N1853t0E2dWnOQ+f7yNqClFzTsb:s83zcW96mG1c+59Q+f7iTlFzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069145, "uuid": "b9e9276c-a672-4220-91a1-f1f0e3da6402", "value": 472200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069145, "uuid": "c420f767-93d9-4ba1-b501-fbb71ecb701c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069145, "uuid": "8b7ef7b4-7ca0-4baf-a9d1-e1aaabb1ff22", "value": "demand rpkb 060923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b5496d-4d8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694097480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694097480, "uuid": "cf8930d6-0d24-4a73-9787-f5ea98265bd0", "comment": "Malware payload", "value": "9c35f51cf7f1693fb70c90b9f60b7b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694097480, "uuid": "db8e3b7f-987a-40e4-a077-2c3fa8f4c8d7", "comment": "Malware payload", "value": "7489d4478db9f9102f3bc8ef2c2878ac142512aba3d4fe8fc88b01b2fda6cff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694097480, "uuid": "b0a741af-54cd-4a27-b946-b8d0eba7aabc", "comment": "Malware payload", "value": "e88bc4b79ef5368023c967c54f2e23febd997454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694097480, "uuid": "22328bae-5472-4de9-b45c-51e3380e0004", "comment": "Malware payload", "value": "4904aa32bcff4b5082ebc4cb4af197e9975aab98e3bca725c0d47092573e949a8b40ab9de96258f55776fd1ce922ee3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694097480, "uuid": "c67e690d-8dc9-4eed-9580-ebf4e3d696ea", "value": "T1C416187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694097480, "uuid": "04ce7027-41f0-4813-a236-1b999dc611df", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694097480, "uuid": "2eef47d1-27bb-4414-8f03-c1a364c297a3", "value": "49152:6gh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcW3jXNO:wa71ffO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694097480, "uuid": "e4990519-b068-4def-8604-fb58c78ce813", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694097480, "uuid": "9a95bf3d-055c-418e-8b5f-e4104e3f369e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694097480, "uuid": "5b94b80d-ac77-4432-8a63-8787c6ca6da8", "value": "SecuriteInfo.com.Trojan.Packed2.45650.5316.19802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3981b5e-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075788, "uuid": "b3d32ea2-a25c-4511-8004-8a21c776c4c1", "comment": "Malware payload (ConnectWise)", "value": "ed5244b1e197369f62e570112c2b33b1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075788, "uuid": "60b6d405-6b30-4574-a405-c22cee239217", "comment": "Malware payload (ConnectWise)", "value": "74cca955ea29be387acdbbcb26516b62758c65e610145aef23c111f90ba7ae9a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075788, "uuid": "3a161016-8e67-4351-9a1e-1bcc0623b27d", "comment": "Malware payload (ConnectWise)", "value": "0c877d0f20868a35d4268a2fbe6fca05684af168", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075788, "uuid": "102b9298-5d97-41d5-a3f5-d999170a671b", "comment": "Malware payload (ConnectWise)", "value": "52e67fe3e01f0336ec919fba990c738c54c76f5cef96d932e5ae36603e8876315f41927429bb1e11e2523d899a98bcf3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075788, "uuid": "66460dfd-489f-45e6-8cab-c62a67c4a030", "value": "T14C835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075788, "uuid": "3bff0910-afed-44eb-8aa1-a126500bcfdd", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075788, "uuid": "7bfaca6d-ecd5-4cc8-bd62-37ba14f65491", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3ok:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075788, "uuid": "ff427ce8-e93c-47d9-9de1-7f5966bb39d5", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075788, "uuid": "b8adbd73-ef27-4bcb-b3ca-e7d877485165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075788, "uuid": "623905af-e71b-4595-b720-d01f72f673c0", "value": "ed5244b1e197369f62e570112c2b33b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a4037a-4da7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694109052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109052, "uuid": "5361db33-266c-4690-82f4-7e23c50e429b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d5cf6841dd3e1a7e76d77d0a96c34789", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109052, "uuid": "c788fb5f-5d69-43df-88f7-350222538c3c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "75a741eb4e59010b49520e85c949c610ddec55cd89ea954178a12e6b45551483", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109052, "uuid": "b0aaf4f0-628b-436b-88c9-7fbd6bb08737", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b6ec0466faa0ba389da3f04e490e4cf1bbaa06d7", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109052, "uuid": "146414a7-b6c9-4cbc-8d8e-fbb83b5c18f8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3afd526a86cfbe9d982a40a0111069050f44cbe90575eda3259514ea31aa1b1874ba8d9004ae50746f71cb0281ad50b3", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109052, "uuid": "4bf6d901-512f-435f-821f-e4dc51818037", "value": "T1A6553311E76198F9E47187F8AD27F2050EB6FC32101C194835FE0E9B8B6F6A59C8635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109052, "uuid": "b9a26fa5-3479-429a-9a91-9b76cfc4800d", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109052, "uuid": "567fcfd7-3829-423e-bac9-c96362165028", "value": "24576:WI39dKbYY4mwVWmsWQy8Iw3mys1Z/QUo7swnaDL4me1i9RYhgebVKoyInpD:W6dkCWHW1BwYZf4meY0VbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109052, "uuid": "84def35e-85ff-405a-8811-01df5d9b91d7", "value": 1295428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109052, "uuid": "19c1017a-cdc2-4e06-9a25-36742f87eaaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109052, "uuid": "c416afe9-2f49-44ca-b898-88ad458d91e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c395cf57-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079707, "uuid": "9c7cbe91-fcea-4fbf-8c10-e98733cc04b7", "comment": "Malware payload (Mirai)", "value": "c0a22939d986f1171439f9c1f8aa340a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079707, "uuid": "73b65823-c6be-40fc-aa81-b2798714af60", "comment": "Malware payload (Mirai)", "value": "75b1d0bdf122d5f40f9bde76703a13ba7c080e9b6c653be12ebad15652eb6edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079707, "uuid": "ac111e5a-605d-4610-8505-70895d8870db", "comment": "Malware payload (Mirai)", "value": "c41fb02aed9784fe2ded8b25777226592d42517b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079707, "uuid": "ba769333-72cd-4e25-ac00-7fa60093512e", "comment": "Malware payload (Mirai)", "value": "6158f4540b0024c26c34db2ce1f1df78894bb1687db42805d92b075b2b47ddc8088dff81de8a7dd5ed39f931c4735a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079707, "uuid": "415e7a89-235b-4f3e-a5ca-3ff05dfd98ee", "value": "T10AB2C0E48B955616C6F0B435937C8F926A3B06E4C5F638262B2093BCD68149673FDEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079707, "uuid": "c579633e-dab1-4cfd-89b7-e7845ba56eef", "value": "384:4CQKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+B8lkhymdGUop5hu7g:4CQKQFH0rs3zWoDDRsjt7LB9U+Bxs3Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079707, "uuid": "f31e6a26-65ec-4e1f-a69a-b5ee0d91d5da", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079707, "uuid": "dfcc366b-629a-4a6e-94ff-f9fc4c149eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079707, "uuid": "5c437b49-16cb-4476-9aa2-829ee569a887", "value": "c0a22939d986f1171439f9c1f8aa340a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71dc4d1-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119281, "uuid": "9a9401be-9676-40f2-8eaf-73f1d58cec08", "comment": "Malware payload (Mirai)", "value": "3bfa913655480cf9c9930d1f9bb62db6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119281, "uuid": "f84cc556-27f2-480d-b802-90517cfc84ea", "comment": "Malware payload (Mirai)", "value": "75d6c4e7860ccf5a7ff9fc153792ee5b0885d12f4b14e0c34d2b527dfb9de87e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119281, "uuid": "a56bdf14-804b-4789-8b8e-59c701123fbb", "comment": "Malware payload (Mirai)", "value": "195e67d87ffb5ffcc9bb86fe4d17cfa1c111d204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119281, "uuid": "86bcf3ab-2339-4dc4-a7ad-411bf590af55", "comment": "Malware payload (Mirai)", "value": "d6eba6f28f43b13752f8df42ff385ec3bdd9bfdfb2ed0b5f1499129f5a26122045d31e836f0b1d882ac5b040d32d41d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119281, "uuid": "61a5fd74-4b10-4735-aea1-66eb53eb4660", "value": "T1C1C2D0E07726FE31C5206C3DE52A4D893A511A7CD1FF353664158C398EC265B63B88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119281, "uuid": "3305ac2e-c7f4-4375-bcfd-2a5cc67ed336", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrV9q3UELun:NKy4qfqoeJdXWgoLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119281, "uuid": "3730e40e-d2ec-4538-be91-70d30469b089", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119281, "uuid": "9b40010b-49ca-4116-8fc2-3e4cbee232cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119281, "uuid": "11333d0a-c882-4e9e-9555-df9db4be250d", "value": "3bfa913655480cf9c9930d1f9bb62db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1862ec2c-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103042, "uuid": "094bff96-69fc-4f12-a566-9254c0c4b1d3", "comment": "Malware payload (Mirai)", "value": "156866a9eb2c7ab3172052cc46f498fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103042, "uuid": "5110cb86-9cc6-446a-b4fc-9593ef8a6f74", "comment": "Malware payload (Mirai)", "value": "75e8e5caa91bcd88e77ced8173af0f47c6d3d04dff37088a1a449a1360d3b7e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103042, "uuid": "4d158eac-d3d1-40a7-bc68-6a3f57efa662", "comment": "Malware payload (Mirai)", "value": "4856dfc998c31434ba7330aba8a263d73f4afc0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103042, "uuid": "49df3e22-d581-42db-aa9a-ec21550904bf", "comment": "Malware payload (Mirai)", "value": "2b8385c0cd0b2a2409e1f6ab12229130e63e7ed724ec8d70d5da81ee8855f1b91e0344c60e733be09fccb56314f2bf9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103042, "uuid": "fc9bb0f5-d20b-4e7c-a43a-947b154899b5", "value": "T125E2F1939371A412DE783BF1FDAA85CB26BD4BACD27A30A3170552182E5A0434F3C593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103042, "uuid": "842be2b3-69e1-4913-b02d-8ee86d72788c", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XeNwWF9q3UEL5I/:1orm1vpALgUJeNwtLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103042, "uuid": "974438a7-93f6-49be-b4c2-e5f2ea1a341e", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103042, "uuid": "e73f66df-bc7a-4d0a-90d5-07664cb2a7fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103042, "uuid": "c307fade-f2c2-451f-8daf-b576d3e0c4e2", "value": "156866a9eb2c7ab3172052cc46f498fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c6afb4-4d42-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694065804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065804, "uuid": "f7c2c2da-5535-43ae-8e8d-c7f16cd7ba24", "comment": "Malware payload (Mirai)", "value": "bd19c6a8b52e4b49ca3553384cb5605b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065804, "uuid": "269ab1dd-1eb9-4f1a-9df4-9290cdc5090e", "comment": "Malware payload (Mirai)", "value": "76d356ec7f2ed3edebb5f666b011c4069b4a18d156209679d45798710b1194c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065804, "uuid": "dbad9e5a-781b-41a6-98c0-4bc7eafa9fa4", "comment": "Malware payload (Mirai)", "value": "e927e1b2a0989fe1c325ab50cd36943aa9b9b55d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065804, "uuid": "7b4ceb93-d4da-4238-8ad4-3b904e152e1c", "comment": "Malware payload (Mirai)", "value": "4ee285f35fa3e5684a361405510f160e5cc6383b8ac7b87d866a1a445a9c678eec98b770dd91cd5650ab8d466529700b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065804, "uuid": "9f08ecea-8052-469c-9ed6-db38acd7a44c", "value": "T1C2C33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065804, "uuid": "56aa1342-2302-4f4d-920e-e8cacc780489", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl711+b2L8M/91ce/:skHK8uz4hlVPqRJd2NIb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694065804, "uuid": "f52585c6-57f0-4551-bbd2-133c4e6b4fe5", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694065804, "uuid": "f1f8b218-8845-4d9c-aadb-cd17e3c435b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065804, "uuid": "09faf410-f360-4cbb-9132-7209ff1c85e2", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50ed583-4d87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095574, "uuid": "1361ec7b-6bcb-4d83-8937-cc2a85fe9109", "comment": "Malware payload", "value": "5cd1f1a39547e9be00be81a89804f8c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095574, "uuid": "5605fc32-70f9-4bfa-aa14-3e0db79faf32", "comment": "Malware payload", "value": "76f692234692cb3753f2aefa85f9a16ea4d5e0f0240b32f8653b250d23c55758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095574, "uuid": "a53293de-7d3b-4f05-8c3d-3e01a0c70dd5", "comment": "Malware payload", "value": "b3e138e9a0fd6f48aacd0c842febafdd4bc48655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095574, "uuid": "41ff7484-34b2-4a6d-8bc0-77e7dc92e084", "comment": "Malware payload", "value": "81e649519057d62300ff5cd33cf1d055d0b1fc39cfc272bced746e35fdc5b84c293bf00046b01343e59322c5810737ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095574, "uuid": "a5d1eb7f-fbf4-441d-b365-388ec4afb18c", "value": "T1214633F515308802DAE42B38A9C74815F256252D345D0F9ABFAF8C2FC08B197AB9975F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095574, "uuid": "dca25da3-e12a-4adb-8abf-c75530f4541c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095574, "uuid": "c60c136f-6068-4a3d-bb28-7aa2f2a03307", "value": "98304:BF2aT72FNf/nm5NxCJsIa6JAaWBEw3wmKnNgzrpEUW3:P2MUNf/8NYJs36fWBRsNops", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095574, "uuid": "2793f426-b7de-4bc4-b0b7-316b7a86e6ce", "value": 5414912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095574, "uuid": "a076108f-7108-41e1-be6c-3ebaefb5a912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095574, "uuid": "f21c1905-c232-418e-a44a-2437da97066e", "value": "VeraCrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cccff4-4d5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694077408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077408, "uuid": "c5ac4e07-8222-40c3-9029-c7a9709ad753", "comment": "Malware payload", "value": "16fb123bcbfdfacedc14f1a016288791", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "fake pdf downloader", "colour": "#8F63AE", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077408, "uuid": "148528fd-7bda-4fcb-9c88-63495a780af2", "comment": "Malware payload", "value": "76f7e0a25ca1819d9c2b4515ac73234c215c0bdd487ae3fe93677ca57595cf0c", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "fake pdf downloader", "colour": "#8F63AE", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077408, "uuid": "10d56502-fc3b-4f04-b78c-0adb39c4fa3d", "comment": "Malware payload", "value": "5b36afd99bc5fa7e5894d43cce99914969aa2cb7", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "fake pdf downloader", "colour": "#8F63AE", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077408, "uuid": "efc3792b-768e-4f4e-a26d-026d6c30e99d", "comment": "Malware payload", "value": "7d7e62f69c4038243e157d30e4d8fca56bdc3548b6e46f94c80bc106bb4ede05ccdb332a32d608a226cd4a14a845cf26", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "fake pdf downloader", "colour": "#8F63AE", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077408, "uuid": "e1a1963b-6873-4248-b2dc-993a9449fd7e", "value": "T11CB012724C362E8E1DE31D680443321EF19A009AB583A9C57501143C8C5FA437DDC7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077408, "uuid": "2d1f7313-5295-45bd-a77d-0615246056a2", "value": "3:mKDDFRKT8AdpV/YFFSOQ0jaXM3evKaulyR82nn:h+8Ado/nQ013evYyR82nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077408, "uuid": "0f99c995-0faa-47ed-a52f-7486623cd1ac", "value": 110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077408, "uuid": "119344ea-db51-4dc6-a15b-a6d72c82c457", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077408, "uuid": "fbb6042e-abce-4989-87da-c39114a066b0", "value": "installer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56df12a-4d8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694098206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098206, "uuid": "30881bf3-e8f0-4b11-8ca7-8421005e0fe6", "comment": "Malware payload (Mirai)", "value": "4e0d022779790c0f1ad7be2e88d4a7f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098206, "uuid": "16e5248c-4469-4843-9da4-762987a263c6", "comment": "Malware payload (Mirai)", "value": "77042ae0db71ec45b7e467130b56a5d73adfd085a856e12ab71ac1735197770d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098206, "uuid": "bb68e982-6806-4a83-b1b1-17e7a0907549", "comment": "Malware payload (Mirai)", "value": "dec9118f7c45008282485db6ae141bc909308c28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098206, "uuid": "6c8196ea-6cba-48c8-8c3c-75693248bca2", "comment": "Malware payload (Mirai)", "value": "c58c71cbffe2519aeede97c866585fdf9570d758c7dc833f0a37775ce7e6478f452ce8ec4bf872a50c1257a90f794dd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098206, "uuid": "40b3c627-181f-4197-ba66-4318c2a67222", "value": "T19E230271890F9EB165303C76EAD5D393B6F125B1C6673023DA280A3C6F75A131E0BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098206, "uuid": "d63c59a5-7785-40a2-9ee0-83533d7fe490", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3k9q3UELbUXfi6nVMQHI4vcGpvI:DECFd+A6YHAxNLRQZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694098206, "uuid": "6ebf6db5-4899-4ada-8fac-1d21e3227050", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694098206, "uuid": "13042594-5a64-43d2-8adc-895e7caa542f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098206, "uuid": "4db90fad-7cec-40f8-a0e5-ee50e6b6e110", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec67b00-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694096047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096047, "uuid": "f0115e68-cb16-4353-9c68-9abfd15f4ba7", "comment": "Malware payload (RemcosRAT)", "value": "bb07f51bd5bcb653c780f736b76c68b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096047, "uuid": "89c3b2be-0edc-4df2-bc88-c736ccd504d3", "comment": "Malware payload (RemcosRAT)", "value": "77a212acb085452ca18fb49ab215f252c8d237f7fb13f937323892d13bc704c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096047, "uuid": "362c3f1f-6912-4789-9dcc-b14c04c998ca", "comment": "Malware payload (RemcosRAT)", "value": "1099708bc920dba4879c6541e9fbecc49312b581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096047, "uuid": "ee53cf39-287e-431a-a02f-5c1566e65ec3", "comment": "Malware payload (RemcosRAT)", "value": "cbdffbc7e97c27ad5c793fd4eb48fba1d4ceb77424bf2a12866ab4b6e85322b82aa7ab4e7f0605018662d8aebe46fa79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096047, "uuid": "2e7f65e2-f36b-4daf-9f95-299d43baa743", "value": "T138236D0037988136E6FD4BB4ADF2A2058679D66B2A03D7596DC810EE1B03FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096047, "uuid": "838eb1a6-3306-4a72-98af-ed996dffc226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096047, "uuid": "279ca143-d5aa-4db1-ba55-f337251fe237", "value": "768:Eq+s3pUtDILNCCa+DiP9FkRtBLVuOqrij3CYbPgelOXrXjCvEgK/JDZVc6KN:Eq+AGtQOlFkJLI23hb4SIrTCnkJDZVcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096047, "uuid": "36f86ce5-d00c-4ad1-a9e2-6da5e669a19a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096047, "uuid": "68b1ed85-def2-4acc-a281-e1cc7822d740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096047, "uuid": "733407e1-9604-4dd5-9528-5571f5db5288", "value": "decode_dd7edb78d7239735bbf070387a1453f68c4b747012b879c17c30948e5989286b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc51e0ba-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Urelas)", "timestamp": 1694084876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084876, "uuid": "8d0dd8ae-3f4b-4ad9-9fb6-bd6d4d37e862", "comment": "Malware payload (Urelas)", "value": "16cac1b280cd8938f037e47e16d8c984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084876, "uuid": "6c2eea73-c059-4b29-8bc5-aedfe2640d44", "comment": "Malware payload (Urelas)", "value": "77aec1e0419cda5a174380c2103b6749b16022e440fd68485192889741f5bd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084876, "uuid": "938e7efd-cbb2-47d8-87b3-b774daa9d98f", "comment": "Malware payload (Urelas)", "value": "8434aff9cd53afa8efe846e1fb4a0cee55ff3054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084876, "uuid": "7e3e2c1e-5a0f-465b-a2dc-81cd73065f7b", "comment": "Malware payload (Urelas)", "value": "c01d500111c8314142444cfe69511c97399f67fd5c97fca3b029f541daad4c3173cd8694c5caa098e857d20b8170114c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084876, "uuid": "aecec0d8-e9cc-4829-aa51-18f028add9df", "value": "T120A49C147640D4B6E32A0B310456FAB44A696C3A17E5E48FF3383E766A312D3977B24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084876, "uuid": "51af5136-0c17-4a56-89bb-fbbed1e781b5", "value": "a74af8b06f2835630017cd7cc4b0782d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084876, "uuid": "57486c98-9e3d-4a11-8094-8b14fedd5178", "value": "6144:LEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhVOpdFRdmj:LMpASIcWYx2U6hAJVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084876, "uuid": "d203b717-646b-486e-9968-354e92194d6f", "value": 469766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084876, "uuid": "e784e188-8524-41e1-81ef-b38093680789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084876, "uuid": "9007248a-45e6-4fa8-bf46-11238a50bcfb", "value": "Trojan.Autorun.ATA_virussign.com_16cac1b280cd8938f037e47e16d8c984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beaf111b-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694079699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079699, "uuid": "cbdd8a76-47dc-41f5-a86d-fcc060aebabf", "comment": "Malware payload (Formbook)", "value": "5a2f3553f03bea972618a4fc780146ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079699, "uuid": "154034fb-63e1-4ec0-8aab-0562a4db2fe4", "comment": "Malware payload (Formbook)", "value": "77d0637c23e62aacd06cdae1199620955f5ef36ccd6b7de96f49ea6637f18ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079699, "uuid": "9966e05c-8359-4f10-951a-1759c5ff1839", "comment": "Malware payload (Formbook)", "value": "64f99d05aca898872289fc7b1ccde4bb6f703bb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079699, "uuid": "ee3ba502-2a19-4861-bd0f-0d6956b08b44", "comment": "Malware payload (Formbook)", "value": "d25ec8be2f0db62929a2e72ec35061ab43076320dd6cb2b89929ca67eca21570e86b956ce5eacee242d19763ebc21de5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079699, "uuid": "cf8cc3c2-49ff-4f21-a121-9dfccf4a2af1", "value": "T162D4EFF92465C7E2C7B483FF54AB84759A23BC02647486CC377C3A845EA5ED34826DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079699, "uuid": "6f7d7e9f-3d1a-4546-8ba1-ec2ee0aa9738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079699, "uuid": "02e29b3b-b81a-4ce5-a995-72a088f6eabd", "value": "12288:F5fVsbR2ZLqq2h8zMm8qslD4QBi4LYbOvCpbie7K3RJdTfIQ90ZE7HKS/S:FtO2ZLRD8LlD4UYbXI6KBJJfIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079699, "uuid": "72185485-a058-44c9-9273-4e944ec91431", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079699, "uuid": "cfd86901-c9db-41ad-a30b-07712a73ee93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079699, "uuid": "b66d1c73-ffa1-4327-af73-e8ae3514ba57", "value": "5a2f3553f03bea972618a4fc780146ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7a381f-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102729, "uuid": "d18bb5eb-81b6-4a39-9798-ae772759feb3", "comment": "Malware payload (Mirai)", "value": "711f683daf661b7ce2996d361fbe0bf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102729, "uuid": "107ec73a-05ce-4f79-8150-2cec388e49a4", "comment": "Malware payload (Mirai)", "value": "78ef63f6c5ba665ecb0fb20013a213a53c9c221480fc34efbf0c65621521ffb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102729, "uuid": "ac1a7fed-84ab-472c-ac80-e66807dddde1", "comment": "Malware payload (Mirai)", "value": "fc9d0370d3fe9805d7b82eab455fdc2da0d5bb0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102729, "uuid": "72ba4552-af12-44bd-97d2-a44e1d5e152b", "comment": "Malware payload (Mirai)", "value": "64c23f2cb6c05d3123bbeaf6e2374016b8aff0bf4c7ed29511fdecabcc5b1ad499f28368fd80f4ea89e7cc1e0ca0c4bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102729, "uuid": "2ca896f8-8cb2-4ae4-b2f5-a5f2115dcf71", "value": "T14C533B99F4029E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102729, "uuid": "4be4f8c0-5084-47de-8040-20114e698689", "value": "768:Ge4gpsM204GEkRbj3eX0unQiaQtdf3gFHS1eu48B8vB6J7EzNfXuuJpoz843M:Go3EkRbrzViXUFS1X48B2SEzNfeuJmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102729, "uuid": "59989f00-5d46-4db5-bd9d-1c16f538c701", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102729, "uuid": "bcd66b39-9eb3-458a-8145-0acc34ffee98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102729, "uuid": "e8d89797-ce60-4e74-9d26-c592acf173c7", "value": "711f683daf661b7ce2996d361fbe0bf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb918ab-4d46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694067722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067722, "uuid": "201de5cc-2541-4192-9649-625024dd0501", "comment": "Malware payload (RedLineStealer)", "value": "9948e214db2737ab8a0b66316a2ead2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067722, "uuid": "b8bbc3bf-6acd-4208-bf8c-db6035f4ac99", "comment": "Malware payload (RedLineStealer)", "value": "7901ae7b82aa0a020e234788d14d2a85a984054fb31050f92f614a2b5f4351c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067722, "uuid": "f88a73e4-2914-4308-a481-adefe07e0280", "comment": "Malware payload (RedLineStealer)", "value": "d754730ea6de7ca10c6698092eaa99426071a57a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067722, "uuid": "d558fc0b-e5f2-4474-9ac2-ad475f1dc0b0", "comment": "Malware payload (RedLineStealer)", "value": "61f918e7e6b001e50b7e441db3e02d5cbffa44853c9a2719920cc0ad79eda1d0ca62c86a91de0ce2652e5446d09c49be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067722, "uuid": "0ba81fdd-369b-4838-81d8-ac8222b612d8", "value": "T108E41246ABE55573C8B617701CF602D30B32BDB54E70836B2399A99B1CB23D6613273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067722, "uuid": "200324fc-888f-4b75-8917-e77970b5f6d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067722, "uuid": "1d83c33b-1e6c-4824-b917-b6feddf64dff", "value": "12288:KMrYy90/EJbQSdTl+fAK8Si2iBMxfjQAdz7V7GoIWHveN4gN:ey1QYzK8nru7jdzbxa4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067722, "uuid": "5d288d2e-a6ce-4129-b744-6482890e6236", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067722, "uuid": "18812a50-0fda-4596-9ad9-ddfb23a2c6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067722, "uuid": "1bfd9fb2-8450-455f-bb8b-3f0bb4100f3e", "value": "9948e214db2737ab8a0b66316a2ead2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac75155-4dc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694121327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121327, "uuid": "681c4976-4988-4d99-a169-c7e9e17d3263", "comment": "Malware payload (MarsStealer)", "value": "4a60eaeb372efc2fa1e93035947d4f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121327, "uuid": "9f5afd66-f3d1-49ae-bc85-415d31b74455", "comment": "Malware payload (MarsStealer)", "value": "79c55c8612d1febdd0a41a5c27c74515ad1a0611b5a2c97fbde3d60fc976b545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121327, "uuid": "07de1e82-a123-4b3a-ad41-e7163fcb609f", "comment": "Malware payload (MarsStealer)", "value": "1a9ffc3f7301258496680c64ea99666f4012ec7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121327, "uuid": "789441af-49ee-4e39-9e0e-3b00bc52c428", "comment": "Malware payload (MarsStealer)", "value": "da9f67d31ce0ff91342598c0435eae0565f286a8304a00a302144b7b9b073efed4ff15cc14668307d3d7df2aa6bc484f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121327, "uuid": "51926a5f-96a4-414f-b5a0-d22b84170eb7", "value": "T1CBF3D07A14BA263DDA7988BED517F374706DAF980A823D4B76051CE0CD311CF4B81AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121327, "uuid": "a41441bf-fa91-41f1-9408-f0cf41852c41", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121327, "uuid": "02b871aa-147e-40d1-8df6-57191f2cb80a", "value": "3072:Uxn9MOKTdfKruYYHrZU8SteeLPby7538OdOp7yKJSp8Bb8EG:wwdIYLcby18zpB8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694121327, "uuid": "4e7c3a52-8dcd-47ae-8ea8-a4809427d7b1", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694121327, "uuid": "5dacaf2f-ca25-4d38-9162-b3ba5ae87ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121327, "uuid": "472962e1-ffd6-4277-a998-822ecb0840c5", "value": "Electrum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3febb94-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694096056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096056, "uuid": "95ced63d-001f-4b43-bbea-a273a4324245", "comment": "Malware payload (AsyncRAT)", "value": "d6bdde1026f2ac6d4e26f3e8b2453925", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096056, "uuid": "d83fcc72-74b5-4472-a193-4e189f3a2daf", "comment": "Malware payload (AsyncRAT)", "value": "79d845cdc5127ee753555f48f2ff555c85894235f2f7d2da74fd83d0d5672599", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096056, "uuid": "df5b46ea-b6b9-424b-9311-1a4043189f67", "comment": "Malware payload (AsyncRAT)", "value": "2d46f053a1e2089e7a1699a3d02d4b096166c5e0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096056, "uuid": "5b2e8b57-71f5-4d11-8f53-c5cd0b43c60b", "comment": "Malware payload (AsyncRAT)", "value": "8f3bc64b2f1796db95f91dd9760cffc24df07cc1c26d390dbe36624a236de10e19de5e75952a0d712430bfdd2b3641cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096056, "uuid": "641a94e5-7e5b-43a9-9590-a6698d1993c2", "value": "T10A235C403798C136E2FD4BB8ADF2A2458279D62B6903C6597CC814EA1F13FC59A136FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096056, "uuid": "744df77f-19f7-4e23-8f9f-c423eaf205d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096056, "uuid": "492044b4-35e5-445e-a0f5-9e284cde0945", "value": "768:V9umxLiIL1CaS+DiNzHlkcWu5i7MYb5geavF0WvEgK/JzZVc6KN:V9uAPWNzHl/WuqDbWzFTnkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096056, "uuid": "b1a982e0-badf-4b4d-8052-f0b639cc01db", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096056, "uuid": "ba0b8f7f-7e8c-416e-8e5d-a77c23a8c36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096056, "uuid": "203f3b36-af9d-4a12-9923-c504c9f343bb", "value": "decode_f3c39dee68c0e8579c2cce048a1410750d7dfdafe30c9db1167b9bd1c350ea1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10925db1-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069099, "uuid": "28312ad1-22d4-454d-805b-bcd1bc1894a7", "comment": "Malware payload (AgentTesla)", "value": "cf7de4b69c33c1a5555bb9bd670bd3ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069099, "uuid": "1bb76578-1a17-43eb-bd8b-e6b801ce0bce", "comment": "Malware payload (AgentTesla)", "value": "7a00fd5b547584ce7ad5b1818c1c889152a7087f27bdfd9e6ed388befe6b6eeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069099, "uuid": "5032181b-f0b3-467f-bd09-eac9c16743cb", "comment": "Malware payload (AgentTesla)", "value": "063d7a63a3e2ae0690a87ef3d472f6688ee5f699", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069099, "uuid": "e8996ed7-2c56-4377-939b-7819677648e1", "comment": "Malware payload (AgentTesla)", "value": "5bd8d2dfa117013a52e4fefedf8856d25dbc8c28d94b04b450ef55037bbf837e4ac5b7341243361cf45b2eaadfc68958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069099, "uuid": "f338510b-4390-40c8-b220-ba2b84ec9dc4", "value": "T103C4123B0581D06EF0B5977DB69C1AC119EE80D8B292D7D25F4A0AE63E11B04F35E7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069099, "uuid": "8e71e1f8-81d6-49cf-93cf-7e69b0c62978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069099, "uuid": "08d551cd-4f50-4c7a-909a-65e4dca193aa", "value": "12288:qj+/ltHKdUJgQoCMorojWfnmjGvY+3ppcXmC0KLmESvAhU:qjWltRyQoCMorZCGvY4ExwESvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069099, "uuid": "373e0a2a-c2cf-4378-9494-3e65c74ec201", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069099, "uuid": "091b30f2-fb12-4ca5-9a46-b39e30469385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069099, "uuid": "4012d213-aac5-4e09-849c-4bb73fe387a9", "value": "22.08.2023 Hesap Ekstresi.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c61002f-4d7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694091131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091131, "uuid": "7e1f0d55-ff82-4e49-a225-c1a666f56fa0", "comment": "Malware payload (njrat)", "value": "8cc957dfad0d172be33dff5f330933b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091131, "uuid": "2d542afd-ae87-4dee-8063-59e0bb0da921", "comment": "Malware payload (njrat)", "value": "7a3a9bed1252cd09631efc4670523563adf8402eeac3aaaf7fdd90a2e586ff9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091131, "uuid": "f38237ed-a340-4b21-b6cd-6779344d9cab", "comment": "Malware payload (njrat)", "value": "c64e66219b9af747f32a0478a963354d873db256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091131, "uuid": "bb6c62f5-8759-431c-b1c1-d0a63e0e5062", "comment": "Malware payload (njrat)", "value": "36f83ca3ce62575e8bf2470bcba22a70a3834728f46766533a0385051cec8f3854d097e52568bde23cbb680baf1368d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091131, "uuid": "e4895ef5-2ac1-4282-adf8-d034a4875f28", "value": "T12E13E78CB784E175D5FF8BF1B492B2890B71A017A902930F99F154D98FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091131, "uuid": "4083cce6-b43c-427d-b820-6497c6ac02b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091131, "uuid": "c5d899bf-b69e-45e1-995d-0ba73c08b320", "value": "384:qZyPe5ctOnwtOyW6Ldsci0Ei3Y6Mo2L2Ifa9D9O5UE5QzwBlpJNakkjh/TzF7pWJ:otqAwt/W6psci0EiIC2LlvQO+G+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694091131, "uuid": "a9b801ed-3d55-4a21-a571-b7e9833c11e5", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694091131, "uuid": "0f052df6-a04c-4b25-8d05-ff906206b2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091131, "uuid": "b775e74d-1bb5-40a8-b618-f47e9da1c6df", "value": "7a3a9bed1252cd09631efc4670523563adf8402eeac3aaaf7fdd90a2e586ff9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e0deeb-4d15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694046370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046370, "uuid": "cc1c04fb-8580-4e20-b901-b6fcdd15b792", "comment": "Malware payload (Amadey)", "value": "d5d06f330fa56d775d7e81fc62bc723e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046370, "uuid": "c3c03459-e048-4a18-8661-ab87d388e422", "comment": "Malware payload (Amadey)", "value": "7a4b5f54a11b2a9b55720d0ebed6513784d1aca0f0ed6fd9edc5671f99b3b1ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046370, "uuid": "6a95d3e9-a7a6-49df-9324-e0d7203b3bed", "comment": "Malware payload (Amadey)", "value": "f373dbae4792cdb76defde715688d4840f45563b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046370, "uuid": "98616684-2521-4ceb-9e92-5780def40bdb", "comment": "Malware payload (Amadey)", "value": "b57cabaa065cac89a3bf0d667971de87c265a05b4c4f969eed0a3a722f306a874278ed179342589aaef4c8938c77c588", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046370, "uuid": "c5280b45-5572-4713-b88c-763221705a17", "value": "T1D224F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046370, "uuid": "389d6924-b7c8-4ef2-b73f-0d7a15a1c4b1", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046370, "uuid": "821dcd8d-4a27-43a7-9b81-cf61006faf9f", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694046370, "uuid": "0e1853b2-9c46-47f9-8a0e-0cf58faddb15", "value": 225261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694046370, "uuid": "52dab230-396c-4c86-b2a1-9ed39f902559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046370, "uuid": "0277b8b7-f377-40e3-bc12-a849ea9fc5e3", "value": "d5d06f330fa56d775d7e81fc62bc723e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c27e75-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075228, "uuid": "f4abf423-67e7-4902-ac29-777448e28108", "comment": "Malware payload (ConnectWise)", "value": "9aeafa3459c48d63e47e8d1871914288", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075228, "uuid": "1b240b1d-cb5b-4755-9fe1-5a128c5e3740", "comment": "Malware payload (ConnectWise)", "value": "7bbe675863a8a03339ebd642ce7c9b209dd3505c4970a41da8d76f8bd679e4d2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075228, "uuid": "80348dfd-ec18-449c-9b24-f09f060064df", "comment": "Malware payload (ConnectWise)", "value": "0ad58657c2ac9890a6dba1c50acd31dc66221043", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075228, "uuid": "25e1d7de-6fda-4909-8cde-a59cab3b6b66", "comment": "Malware payload (ConnectWise)", "value": "68575d6b7f2afbc89032bb463b1f3921285d06ced75f31c8163d93c9cbd331dcbd34de04c666dc4fd6b06cfacd3e016d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075228, "uuid": "9b63e40d-4bc8-4e24-add2-7335ae72acd2", "value": "T155E5121136F9427AF6FB2B35BD3E91606D3ABC691E20C11E5354750E0E72A80CAB6773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075228, "uuid": "424b2855-556e-49f0-9c26-d8f51bbc027f", "value": "49152:PtzP/DQtSwBLlw6f4H7GxIcrq6x4dYdJSXG6Kk2f2gZgBZgQfpN31gzF:p3nWn4bGbq6adYdsXGLPygQfpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075228, "uuid": "23ade69b-6671-4265-ab47-3b134cf171d8", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075228, "uuid": "e2bf4656-cac8-4893-83c8-19f7921e7b1c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075228, "uuid": "62f255d9-3eb0-4332-b7f7-daaab1913091", "value": "9aeafa3459c48d63e47e8d1871914288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c901dd68-4dd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694130397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130397, "uuid": "2d25f137-7850-4176-845e-45f336c34165", "comment": "Malware payload (RedLineStealer)", "value": "fe4e3c8e2189ee0746f0fa4f37ae47f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130397, "uuid": "1d4f065c-6500-40f3-a595-4956c1d690a3", "comment": "Malware payload (RedLineStealer)", "value": "7bef661ffc9788b5c54e0f98728f34155d7a713f2bfffeb0ef5dc7e33d52aca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130397, "uuid": "56ecff7c-e52c-4527-9213-1a611859b5de", "comment": "Malware payload (RedLineStealer)", "value": "0ac1d676974241e26fcc2fde30bb98460b057817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130397, "uuid": "8bd24738-b210-4ed6-9ab9-32d71fadb15b", "comment": "Malware payload (RedLineStealer)", "value": "d31a96c8bb21f89d67704b1892148535b9d8eecfcc254c9a9407704bf388e3429c40a28a8790579fa18b6aa54ba58a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130397, "uuid": "0faf8332-ee73-4956-b878-74c78a6c7d09", "value": "T159557C0CAAF1EF4AC79E4634D43E0879DA37E65556A3F30B963702A63C973A41E871C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130397, "uuid": "e1f94e08-74b8-47bc-bab0-26339474ea6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130397, "uuid": "46f64149-05c3-4624-af64-0ca8c3a47758", "value": "24576:8xSsS81LH/iWP5kRNntdWbBs65NpGiBKPBh0Serl+BabrC9:ySX8tH/iWhwwNpGn0Serl+Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130397, "uuid": "018c403b-1086-4688-bd8e-a12f2d4f3bea", "value": 1401344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130397, "uuid": "2bc86602-c37f-476e-bf43-eab1e4c45f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130397, "uuid": "a7e10e94-b64c-4037-8bc2-adaa00d143fc", "value": "1.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02104f14-4d89-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096133, "uuid": "2e85054d-3044-4ab0-af99-f7579acc20e8", "comment": "Malware payload", "value": "9d1d1b38eca3d31401c9bd3373e338e3", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096133, "uuid": "8ff4a17d-a264-4953-afab-3c43f51a9e67", "comment": "Malware payload", "value": "7c23557ca6afc8252609f158b4e6d61e7246f8e6064478052c3e35bf2adfbd64", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096133, "uuid": "a0962c58-fca9-46a2-affa-b3b614ed9097", "comment": "Malware payload", "value": "26d21e5a2ab0b1434d8535a1e98d8e27cad7e904", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096133, "uuid": "bc74781a-0e4d-4f24-a7bd-07985708ae4d", "comment": "Malware payload", "value": "9328b16522d9e62da6ec1f4c7f0e94a2367b52cde5eab8caa73e0a9b4f8b0f5eb3fb3050f11384b0712951c08bc71d86", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096133, "uuid": "d7941b7c-19e9-4f7a-aa12-029aa051de6c", "value": "T13611DDB66B2E5022C9B5CB121D47924ECFA041A158C00A04B8FD4E61EE39162A39EACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096133, "uuid": "a6efdaec-8085-4745-9825-cacba251cf48", "value": "24:DOVtyCiSa3jgsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiSa3EsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096133, "uuid": "09f9deec-e279-44a3-9eb7-4325f5011da6", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096133, "uuid": "9ffc994b-085e-4633-952b-2d8ba5835fde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096133, "uuid": "d433fd98-5655-4f7f-af68-2eafd452232c", "value": "ZC4ChiTx.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b718b2fb-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694083122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083122, "uuid": "a76df972-ea01-410c-8e89-f16958e3488a", "comment": "Malware payload (Formbook)", "value": "f322e0c095e368240651044281c55565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083122, "uuid": "88f5aa2f-d7ad-4dd1-8bcd-149ee70c2c14", "comment": "Malware payload (Formbook)", "value": "7c2a5a81e2c8d2f44f4509895323c2478175a74fe0c06518988dbd823cd40a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083122, "uuid": "25afc1e7-8701-4eaf-8ea7-17ea247ada66", "comment": "Malware payload (Formbook)", "value": "9823a9af42236b0d2f8cb0c6d4f657a5086e7496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083122, "uuid": "a11f3fed-f6b6-491d-83c4-6de023a9ccf0", "comment": "Malware payload (Formbook)", "value": "bfe531988e0afaf05e0943d7e80e03dbee71a8a6d2dc11cbacccc8c555eca9dee7e43df66eb1ca041e7d5b3be823cc69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083122, "uuid": "0d64e640-2121-4f15-a073-49bf289563ee", "value": "T14F547D00B591A036E87315330FBD665A963CBA200F146EEBA3C85D2DDF356D1BA31B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083122, "uuid": "45f36082-dd3b-4823-8cd9-8acd669c11c5", "value": "760c0ea399376392700ec8685e5ecb4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083122, "uuid": "e2ef2b91-fb93-4a86-bc1f-576b97229f7d", "value": "3072:EroNBw0l8T1clIQL4Tbpt8tHtJJuv6QytTYQHnlOvA5LTmrqM/7CCuHA1bEgnLtg:EJTwIQWrQ4YZmrqqUHIgg0AOj8ZIU/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083122, "uuid": "6c55350f-f6ee-4ef6-85ee-f2a40e0e3f4b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083122, "uuid": "d28ee8c6-705d-4867-b4a9-e4ab57763f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083122, "uuid": "19431d6f-058b-449b-ba71-43413bd929ec", "value": "SecuriteInfo.com.Win32.PWSX-gen.26626.13453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97375519-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122153, "uuid": "5d98ca4a-a285-44e4-af3a-37cdfb33d1a0", "comment": "Malware payload (Mirai)", "value": "ad14ed8ed4ff3c0cdcfc733c75747df2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122153, "uuid": "e573d887-24a5-4285-a926-a5517b93ff4b", "comment": "Malware payload (Mirai)", "value": "7cf231d7fb1c7a515bcccd486f0fae420326d356a717c2b1753b4cfe05a54339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122153, "uuid": "52fac313-7cdf-4204-85d7-150b802ef422", "comment": "Malware payload (Mirai)", "value": "a601943b643b33ea6c53a033b9b7c83716758409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122153, "uuid": "57b0341d-0da8-4c14-af60-ee66717462ff", "comment": "Malware payload (Mirai)", "value": "79b8a66266c7f379f7401a0dde30e9b0fe06191fcc1d7cabd8cee55eee1d1ad0700cd39e7b80e0006ebf3abb74754b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122153, "uuid": "0b8800a0-01db-466b-9ff9-4c76bc18c2ff", "value": "T145B2D1A487955706C2B0B476E27C8F935A3B16F4D2F639261714C2BCCA8145633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122153, "uuid": "7490e8ea-1763-4ced-bd83-d131aeae7348", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+Bu8cILNhymdGUop5hu7C:4C9KQFH0rs3zWoDDRsjt7LB9U+BuyBsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122153, "uuid": "16239956-114a-40b7-a0b0-d717c3bc5f4b", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122153, "uuid": "6b45b7d6-5aba-476f-b9da-816c31312a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122153, "uuid": "db43c651-85fe-4e54-b90a-bfee3185cc0a", "value": "ad14ed8ed4ff3c0cdcfc733c75747df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567dd4b0-4d20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694051178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051178, "uuid": "fca995c4-00b2-46a6-a8d5-5fa04bf3b4b4", "comment": "Malware payload (Amadey)", "value": "645cdb22a98a28e40bc5196602fb64dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051178, "uuid": "805b3850-d536-4a20-bf2a-6e43f1e98492", "comment": "Malware payload (Amadey)", "value": "7d71f95bb5e39c53ee364d5bb45b3a2225a25529ab0928de20865e04f72fa446", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051178, "uuid": "03f90500-2d79-4873-b6a3-00c3fd4398bd", "comment": "Malware payload (Amadey)", "value": "b68a6c092ee239bc692893d41020ba9a18928524", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051178, "uuid": "0f2ab56c-626b-400c-9ecc-75a2b4120db8", "comment": "Malware payload (Amadey)", "value": "dfceb7b35735a9f3500c1fcc29e97db5a9b8e1decf4115b8fbfa722d368d50c0cad9b11c1b063309a3c6070353633461", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051178, "uuid": "69035909-6169-4be8-91c2-e76e013d8e00", "value": "T1E624F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051178, "uuid": "5e88d70a-f814-4ddf-a6f8-d345897d5553", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051178, "uuid": "48e70b9d-826d-40ee-a347-c93f1b9ab8b8", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694051178, "uuid": "f876e6f1-fe6a-485b-a241-bbfd01040fea", "value": 225386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694051178, "uuid": "189c45bc-521b-473e-8ec2-14c008153b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051178, "uuid": "2df6fa4c-a80f-4f2c-b6a8-0a8d7e23423c", "value": "645cdb22a98a28e40bc5196602fb64dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1453e60e-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111626, "uuid": "f1453c66-c0fc-4e15-8590-91637f0f02ba", "comment": "Malware payload (BumbleBee)", "value": "ff0da6c21a11802a9de368ba916b7b5b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111626, "uuid": "b321ac14-6c0c-45ef-a6ef-56d8c5af5dd3", "comment": "Malware payload (BumbleBee)", "value": "7d968436832d0bc6c0b16629331212f1b92883224345f5265a175a9ad4b6416e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111626, "uuid": "59a03925-2e51-4ff9-9139-3ed60384e979", "comment": "Malware payload (BumbleBee)", "value": "d2225090ebf10b8c504fb018c63eb51276103b20", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111626, "uuid": "06b4548b-c485-43b7-bf8b-d7494625f185", "comment": "Malware payload (BumbleBee)", "value": "a9a27a00158526027afd0fcd8c403ffbadaa8419ed18469c45a38459314729284248fbc4d28867fbdecaeb54ef684640", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111626, "uuid": "d490d5a0-2e14-4849-a1a8-40156f4e4a91", "value": "T11ED4C08FECA1FFEAC42D11B6C88E069D16A3A5402F06097BA56D424872E3B0773D775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111626, "uuid": "21979624-bad9-4d96-9023-b5de9b2cd084", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111626, "uuid": "51514263-a5cb-4827-8998-cabde2a578ce", "value": "12288:drwyo4u1KDhOqNvH4UNWOWITk4d+pddRY2J4zs2kXQz37:drfoODhPvjA4+pdnf4zs2kgL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111626, "uuid": "b8a03616-5af2-4b45-b2dd-c7747bed7bf3", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111626, "uuid": "6b4c4f43-f366-4263-bbb1-f436bd92ca64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111626, "uuid": "7c4a2bff-da99-42fd-87aa-75ecec2827e6", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b206738-4dc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694122401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122401, "uuid": "e5a2d836-693a-4189-86c7-c93a77b3d1ce", "comment": "Malware payload", "value": "6d1995aa049a33a4fdb25dea990db647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122401, "uuid": "3d7b63d1-1461-4158-be66-9c30f3dd734a", "comment": "Malware payload", "value": "7da7bf1b069001c4704733cf709c0847c41221582f93672d204fa268b029e89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122401, "uuid": "82309431-73c8-4b8a-b147-4bd23af1e78f", "comment": "Malware payload", "value": "913e333f2518513320108e94e71a221b0d1997ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122401, "uuid": "37a1ba25-523f-46c2-8589-8c664bc586a1", "comment": "Malware payload", "value": "87b2614e7f62b1285ba6bf2ffb299d1014e740789acbec5b893e5df2114dc9d5d11ec99c4008d90345fa89f51d878963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122401, "uuid": "db72968e-6048-473a-98bd-ef17a1b447c1", "value": "T141D42316226C837DD6A771F019B287A74F738F18B191E64B69E4209E0723FD77C60E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122401, "uuid": "efa103ce-d751-4858-ac85-07e82f82268d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122401, "uuid": "20fb6160-e1dd-4f49-9025-e5a8aaa348fa", "value": "12288:nKxWo4Rkl12TA8++ancJRak8MSu7KwLwNmAgxTTKo8nMhrvjA:Kxj4R+WancJpSmQ6TR8nervjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122401, "uuid": "5de4d4e2-866c-4f69-afcf-c55a9e0416ed", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122401, "uuid": "df8e4509-5bc2-4bd4-876c-62d7560887e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122401, "uuid": "66f73ff0-1fb6-4c72-9e19-bba7d6ad6423", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11184.30885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b3505f-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075715, "uuid": "dd51e604-3782-45ea-8001-2fc380b2f771", "comment": "Malware payload (ConnectWise)", "value": "a61c977cfa4c3b1984dc262529f949da", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075715, "uuid": "c8df9ad3-935d-416c-8fca-608ea9f958e3", "comment": "Malware payload (ConnectWise)", "value": "7fc40521b04dfd962769606fa843542b003bd1d06c2d6eb8f526d615e020d286", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075715, "uuid": "55a5a24b-e150-43c9-b36c-8fb6db6a59c9", "comment": "Malware payload (ConnectWise)", "value": "8d0a9bded8a06d243bf7d0f30ec87bd1695a310f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075715, "uuid": "65178360-cc75-4c37-9d83-345244ed626b", "comment": "Malware payload (ConnectWise)", "value": "d9cd929217279010e61ccaf01bed014b13122f71318c31c6b9f80bf1affef862427c1591bb3ce2fb300a4929d080dee0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075715, "uuid": "5bf89b04-3397-4ecd-a275-b0a062e304d0", "value": "T1DD836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075715, "uuid": "f15258ed-f4fc-457f-a376-3867ee8e8c45", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075715, "uuid": "4fd37f1b-9673-4b0f-b6bb-be74e16c6498", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Bk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075715, "uuid": "73466df0-0c28-40f0-82d3-0f01ee606de2", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075715, "uuid": "e3cc7490-2238-451f-8397-532e57da4987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075715, "uuid": "ed06a619-4193-4c66-84a9-57da7179a0a5", "value": "a61c977cfa4c3b1984dc262529f949da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6151a748-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075677, "uuid": "c15eeac0-1850-4e3a-800a-6880299f81fc", "comment": "Malware payload (ConnectWise)", "value": "7791fc2615cbc58329a16d7bd5823330", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075677, "uuid": "16c0ff2f-0da8-4fb5-ad22-9003b145e505", "comment": "Malware payload (ConnectWise)", "value": "7fd6d67c8278bcfae3810ede185bd4bc5f3d872116522b021db5c426d30d0332", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075677, "uuid": "08324736-de7d-48e6-8626-870b6c3f2913", "comment": "Malware payload (ConnectWise)", "value": "75234cd167d65a91b4f27da5d558fd581630a536", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075677, "uuid": "7f82e1e0-c1f9-4dd2-96af-dd35b9beab39", "comment": "Malware payload (ConnectWise)", "value": "6535e3373399dcbfc3819639c40cf1674b34e0e26852538c9ffdfc540602c60645a19cadfa4c3c08bf830b094dfe772b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075677, "uuid": "bb6579b2-bd9c-4f36-b39e-df812e75930c", "value": "T19B835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075677, "uuid": "911716b9-c188-416f-a184-f8456cd8c830", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075677, "uuid": "db88a5a8-ff86-49a6-b93c-2a42956a4dac", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Ak:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075677, "uuid": "589f5aec-84de-436c-9a32-f57529a42bd9", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075677, "uuid": "ae3c4394-f2b3-4b44-a30d-fc7d6758035b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075677, "uuid": "12daa794-6f2b-4447-81f7-885b8c7be3ab", "value": "7791fc2615cbc58329a16d7bd5823330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37209edf-4dcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694126287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126287, "uuid": "4e5f9c68-944c-471f-a6a6-dc493a858212", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2cf2e32317d38293c3d2946b8b2f2487", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126287, "uuid": "e92c35ba-472d-4304-9cf3-dcb26c08952b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8093be2f5aabcfdb73bf1e6a73161e37d2f702868f974387a032d4e0489516ee", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126287, "uuid": "ee5cb315-4d55-4f8c-820d-973b674ea259", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8aabd86147053d8d22cb8a6731308dd8a19c5da6", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126287, "uuid": "a678d958-f817-41f7-b1f4-d6851a62a2d7", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "63515caedbe8f1db67e262820cdcce537413edb7d33f6127ecef9375c1025900a66c266a6f76e601c8d6b7c45796e267", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126287, "uuid": "cd9b0b8c-20a4-438f-bc02-7074aefb6a1c", "value": "T1935533038F9260F8D0E3D5B4AEB5851A5F713E032C79C40EBBEE3A096727691457B752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126287, "uuid": "7719e15b-9e42-4554-bfa2-c226bab4e085", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126287, "uuid": "e24e47a8-e503-4625-a359-aa4bf1326821", "value": "24576:aI39djHwWmnsou5p/yF78z2Rdj3swTD4C9SpJ9ddnBxmcoQwNjhgebVKoyInpD:a6djQb8dyizgs41AxBrOvVbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694126287, "uuid": "1123419c-8aa8-4f6e-86d0-e00a6b361c03", "value": 1288669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694126287, "uuid": "6b74a8fd-ec44-4226-9170-d5dd8236adbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126287, "uuid": "46bf899a-b102-46bf-96f4-99a6dbe24afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaac2cc2-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071076, "uuid": "a150c358-bd38-4d3d-ae1e-aba14740eba2", "comment": "Malware payload (Mirai)", "value": "98f5a24c5513f44275deb7ec9c8f2443", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071076, "uuid": "792c7ff6-8c4a-4173-8920-a560c7d3f8b3", "comment": "Malware payload (Mirai)", "value": "80b4952d8c65e25af97580aeb9af8028bf0db1b12be526a377669b86b0b71932", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071076, "uuid": "6d158951-93b6-4357-b56d-f03f51da654e", "comment": "Malware payload (Mirai)", "value": "51bb272ac23ea561eb3008130dd5302ab73704ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071076, "uuid": "dc123311-e29c-4ab5-b4a8-f7e88c75b26e", "comment": "Malware payload (Mirai)", "value": "47e019c385b8fc1ecbcf660c23ad5b104bc6b142cad2856132156b81724b05d92d520f616db51325c98f6cf717be610a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071076, "uuid": "713fe745-d5d5-4674-b9a1-4f3b58c2abc9", "value": "T1D8C2D044F1419E41DFEB29F13E44DAD6BBD02F1EAA628E9026A053D25F5D2A78306DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071076, "uuid": "5c3afaba-fcf9-4879-b045-14f5f7f5b2d7", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PSp4uVcqgw09Y:mam+AnKehPRa9a6p4u+qgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071076, "uuid": "b2479ff9-9f4e-47a7-a523-f536a8eedf02", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071076, "uuid": "346c70b5-a7d0-484d-a7ee-aea586e575c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071076, "uuid": "e2c8888a-14ee-4813-bff6-f66f946f6e48", "value": "98f5a24c5513f44275deb7ec9c8f2443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559766d6-4d61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694079093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079093, "uuid": "52e33f97-95f3-4612-bd4d-46e4915a8971", "comment": "Malware payload (Amadey)", "value": "e4d07c9871008edf15a9fc3b061e916d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079093, "uuid": "4858657b-0a6b-449f-8f77-c12c47c59d61", "comment": "Malware payload (Amadey)", "value": "80bbc0e097f694d433ef452ddbb72c0159016d952effee1e69c752dc113fd0e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079093, "uuid": "6e646299-6bcb-4a7d-9881-86cc90779fc8", "comment": "Malware payload (Amadey)", "value": "54ca6e327e628e63b55239fe51d4ec1ae11394c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079093, "uuid": "e86b781e-09e9-4eca-ae19-8988f2ff33cd", "comment": "Malware payload (Amadey)", "value": "d9b36273172b2ca53a30c80306b0a25bc1adb9ae2c96f3afb8f9f4ea313a917ad36b2316472c7686a1aa273f5802d5f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079093, "uuid": "b5f3c267-0668-4af5-af40-ae43be5243be", "value": "T18D05232A7BE48072E8F517B088F113C7163ABD920EBC875B2B4579875CB3A94647173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079093, "uuid": "ded8efff-3527-41e1-993f-b5b1dc5c173b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079093, "uuid": "b35fbb8b-bd9e-43ce-afe9-35e389fa8380", "value": "12288:VMrfy90wnTXmZ9aATysXn7ECSEQAGNHefb5fAp/AyNUcnQe1N50mC3WTAVQu9uyf:WyrTXmCAWs37ECSENlLZlDnhTXGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079093, "uuid": "42be4565-15f0-46f7-bf65-366bdb59d75a", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079093, "uuid": "5fe2ced1-6921-49be-83f0-00737ff65a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079093, "uuid": "9f3d23a5-6c31-4fc0-8c1c-0c6b26623ec2", "value": "e4d07c9871008edf15a9fc3b061e916d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5916f6a9-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067932, "uuid": "77df0979-25ff-4225-9cfe-ac97f137f50d", "comment": "Malware payload (AgentTesla)", "value": "844ed467c9e0c8908079cb61ec5381f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067932, "uuid": "0eb44dd4-eb13-4efe-9039-44e117019ea3", "comment": "Malware payload (AgentTesla)", "value": "8100bdc791ac1a4417e49ad4628144b05c338ffc56ca9cb75623bf7af9c3929d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067932, "uuid": "0c3c1e3c-a381-4bbe-9edb-ef67832a4864", "comment": "Malware payload (AgentTesla)", "value": "c83640a128c4869b402a1cb3e62c141aa8377737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067932, "uuid": "c400bec8-8cff-4017-a2bd-24cbf324194e", "comment": "Malware payload (AgentTesla)", "value": "e14d1f89c937a6119f25ac5e60aff476f3b5dc6d6231d72c028b7da82a3058e02038d5abbffe49caadc5fca243fe1ac8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067932, "uuid": "8f520bad-cb52-467f-9ef1-436f1572bec7", "value": "T1EA337A6CD34F02A9CB52527B9B161A0542FDBB3EF35412B5306C837533EE82DA5252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067932, "uuid": "6f1801e2-eb03-4a14-a9bc-8f442485159f", "value": "768:NwAbZSibMX9gRWjoPzWe+NdBZg0VPLbgquPVoUGIL:NwAlRvz+nvxVPLUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067932, "uuid": "55f0593f-d66d-4a01-9bfd-e5231a3b5f5d", "value": 51148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067932, "uuid": "f02153ab-c754-4e71-a92e-34a052f43831", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067932, "uuid": "f0be7195-2d20-44df-99f9-9a167cd859a7", "value": "SCANNED DOC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1bac9-4d56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694074404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074404, "uuid": "0621bb6e-96ca-425f-972c-8d8355713ec6", "comment": "Malware payload (RedLineStealer)", "value": "c8165698119851b3b361fd544ff31586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074404, "uuid": "81ac2ace-4fa4-48c4-81a5-e3cdc5e5fb5b", "comment": "Malware payload (RedLineStealer)", "value": "812230302931db6ce247497067a4c530f66d6e6be7207566310dada47a42a04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074404, "uuid": "5628681c-2114-4cc3-8ca0-04e7f05d8488", "comment": "Malware payload (RedLineStealer)", "value": "b455b6bc5b7e202016ab125631e1f3179189d52d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074404, "uuid": "22234ffa-5675-4f9b-b263-7ffd0aa3a9c2", "comment": "Malware payload (RedLineStealer)", "value": "4939da4665912e0319d769dd111dc9c794cf7968324ab344ab87333a3a46705a3bfd5685de156457714be5331aee17f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074404, "uuid": "962a7324-738d-4a8b-9d0c-8f0de6b67cfc", "value": "T174D41202EBEC8533D8B12B7468FA03870F717C715E38936B27459A9E4DB2690B47176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074404, "uuid": "4aa949a7-7a8f-4930-91b0-ef457ed6bcfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074404, "uuid": "f8fc20f4-1c3b-442b-850e-e9a5c6af3a56", "value": "12288:+Mrxy90Xt605l1mxJM3UwP+aLyHlFxHINbJpVqVgxxi5REd2WA2:nyAULxJPw2NlFx+J2jREIh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694074404, "uuid": "14dd370d-49e6-4c47-b147-880b5ec41b37", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694074404, "uuid": "2d64415c-bc06-4e64-a853-07d53b4f9dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074404, "uuid": "f41d76d0-8807-4372-b5cf-b403588563d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faaccf6-4db6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694115483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115483, "uuid": "82391965-dee3-4aca-bff2-daecbc1abf35", "comment": "Malware payload", "value": "8e4ee131cb65ae21428c02b48397a21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115483, "uuid": "8eba3589-1f85-4890-9b14-e7cf406b8121", "comment": "Malware payload", "value": "813fa73466099e74e63bd8af801ab3dc30e0c47b5dcb512fd98797f2e0600495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115483, "uuid": "c29d4f8c-864c-4ec2-b52e-679ab9df1ce2", "comment": "Malware payload", "value": "edd1d86776e58cc625ca347f8218899b52bd21c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115483, "uuid": "283178be-b54f-4137-9e0a-bb675a04794c", "comment": "Malware payload", "value": "bf72b8ae52a1eca0c4a72bd74203ef8dd2a3556e75ed7873418f4b1fd1f2ff996c3343f9fee198cb7213c084586e580a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115483, "uuid": "8bf4e910-2527-49db-ba43-b33fc1ad863a", "value": "T106359DB3F6B602B7E9D01938B37A8E1660367524171475C337F86D2D4F6A2E2A936307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115483, "uuid": "7dd45367-970e-4f4c-95c0-4747593a60c0", "value": "8640163fc2b92ed7911366198a2d1927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115483, "uuid": "d92d0182-ca6f-4e34-a7e4-8d5c8aeed4af", "value": "24576:PMyqBvdQ+6DaV2visOC2byCk3s5E14h9j7cEz:PnqBvumZZHLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694115483, "uuid": "a58320b3-3681-4f41-bc13-de975f1fddc7", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694115483, "uuid": "ef2fc493-8da9-490c-b2b7-169dcb12ba65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115483, "uuid": "9e5cd980-8251-4ecf-8469-07736c983cbf", "value": "XP Panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938aa22a-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122147, "uuid": "625dd24e-ca9a-47c5-adb8-79242387ae6e", "comment": "Malware payload (Mirai)", "value": "8330e80010131f116032bd4258768239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122147, "uuid": "38cd306f-18b6-4153-9ed7-814a9a708d7f", "comment": "Malware payload (Mirai)", "value": "8170739d4add64490a996fc9249dc300c6fce38fb4cf2d6542eef080a90c7a14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122147, "uuid": "8c8e1b4f-74ea-4678-9a37-cc15e5bddaf3", "comment": "Malware payload (Mirai)", "value": "e6caa6d5f302698eae66938c089c4bca4d4cec62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122147, "uuid": "e1e3d71e-2c70-4e4c-8411-16083575348d", "comment": "Malware payload (Mirai)", "value": "ccd9077a8aa0c2e3da945b1d79c9ed666006510475f817a941098431df5d5fc0f746b3b0c262c660771c1df34619c68b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122147, "uuid": "6c9927a8-4167-40ee-a782-326af19b64ed", "value": "T18B539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122147, "uuid": "b3f021c2-d6d6-467e-8b76-8762e00c01ec", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122147, "uuid": "a1a44e2d-487a-4e66-8710-b35a3ccb1a2c", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122147, "uuid": "02b60fd1-dab6-48b4-8c12-ea805e328052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122147, "uuid": "8ab15b69-51fa-4764-a0f3-469afaabdea9", "value": "8330e80010131f116032bd4258768239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280a4a62-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694085459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085459, "uuid": "cc5c7d48-e3b2-4210-9d56-00063ae4da09", "comment": "Malware payload (RemcosRAT)", "value": "db7bb3e2019512de2abab139d5b0621a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085459, "uuid": "c1331986-be64-4980-8380-1fe421642bab", "comment": "Malware payload (RemcosRAT)", "value": "81e133f9aae32be3ff7a818fe7fa37eea017740c139e825641cf50dfaaa2a0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085459, "uuid": "4fb3a7ed-2032-4bc6-900a-80612d1d5ea8", "comment": "Malware payload (RemcosRAT)", "value": "091ef2e57f7f678ee12133fe30dc876cccd92056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085459, "uuid": "bf11f328-cadb-46d4-bddb-f6eff6d13284", "comment": "Malware payload (RemcosRAT)", "value": "7c71e106292660ac4a0189ba11c6b348070b88d7a03e7e35d72b7ebd744c8481ceb2e79a479f78fd185fd195eb28230d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085459, "uuid": "5f3a03a6-1aa0-42de-a4cf-f945862ac553", "value": "T12495CD1A38AA100DF261AD7C5BBCB475915EFFF2163A1CBB0DF7254611228F1CB9D226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085459, "uuid": "cbeed27c-e0cb-4a75-a043-4c98d486082f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085459, "uuid": "301a5030-01dd-4643-890b-6e8b2d9e5a79", "value": "12288:bk95kM31x2jHHqbAEosHPWMRiz8ULpoQFRtSs0EYcyXUBi6E5Gj/3bIkGKJNktKy:UY75oILAz6E5GrrJNk+dZBYKYWPit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085459, "uuid": "15cc23b2-d366-49b2-aadc-6bd8fa864ef6", "value": 2008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085459, "uuid": "9359d60c-bc03-40cb-8d79-c09f7232f836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085459, "uuid": "7a68eaa5-03ca-46d3-a72c-339f66acd838", "value": "SCAN 001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949991d4-4db5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694115277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115277, "uuid": "ae6b3f30-d8f2-4df9-8c2c-83c02c613d1a", "comment": "Malware payload", "value": "fdac4036d10a54ae3ba4147f6295b110", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115277, "uuid": "6647d391-b57b-4cce-91ca-238bd4f0905a", "comment": "Malware payload", "value": "82905d46fe15d44a289f023b43d197408fe7eca425cafcc626e744b1cf03271b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115277, "uuid": "d303b93b-651d-4f6a-bf0a-77aa0a2cde2a", "comment": "Malware payload", "value": "a0023ebd4fc37ca4a23e8571f5f5918e3889ded9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694115277, "uuid": "48a73cf8-ca14-4a69-9d25-6be797ab1e48", "comment": "Malware payload", "value": "c1776a1ec94c2fe50d9b65f2c9bb5378b0fc875a7cdc29af045ed388951608a0c0a17723bf6f1095ccf947332b842931", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115277, "uuid": "0131ebe9-c148-472a-816c-1e66bf425a5e", "value": "T17E45AFF876047DE62A6F576BCA96ACDD13B626239ACBA4CD406477C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115277, "uuid": "98481158-83c0-40b6-8ce6-c4850510588e", "value": "24576:nTGrb0PQ/xh/8M9BXzxUk6WtIUhi5fjutA99tfJi+ZtrE/N2e4h0aKE5X/qI:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694115277, "uuid": "0811f9a5-c673-4ea1-95e0-e6095cb3a3ea", "value": 1177763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694115277, "uuid": "954ce8c0-220c-44fb-bbb1-80c7696df169", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694115277, "uuid": "749d4faf-a887-407f-8ba5-b73c5472396f", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.14491.17189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf49b46-4d30-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694058086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694058086, "uuid": "d5a99e28-8b13-4fec-828f-30186424bf8c", "comment": "Malware payload (Amadey)", "value": "e4e74dc9ec121c2337b7376d593a0555", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694058086, "uuid": "09721f5b-8de3-4e5a-8637-b39416bb0aea", "comment": "Malware payload (Amadey)", "value": "8359868387b114d4f06ded290cdb3ecd574f890a287b23ac4c7c5cadc605b578", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694058086, "uuid": "1a9a7d7f-0475-4e75-bc05-48ac26fb1100", "comment": "Malware payload (Amadey)", "value": "55026001fea6c0b149f99f26d2ca1721a80c7848", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694058086, "uuid": "dbde52a6-1ddd-4e95-9821-79ff90d203cd", "comment": "Malware payload (Amadey)", "value": "175124b0d85766c8651b1d5e2a81b7710c46300758063a0a68c60829570a43154507043bfd5b3a7bd2781bccdf14cb3b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694058086, "uuid": "65135755-ccde-4434-828a-380eca0238f0", "value": "T1B524F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694058086, "uuid": "77cd5405-0331-4d50-9c6f-9a48ed46206e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694058086, "uuid": "ecbc929a-9f41-412f-a9a9-61395d8593e2", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694058086, "uuid": "79fbd958-653e-4c12-8fdf-e5f5192fc105", "value": 225736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694058086, "uuid": "6f02f552-0aee-45c8-84c8-94725ccf0051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694058086, "uuid": "d107ac1f-a6fe-49b6-9e43-df12faf84383", "value": "e4e74dc9ec121c2337b7376d593a0555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b947e70b-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "b7dfe3f6-9cb7-4ecd-a16f-3d114ff097a3", "comment": "Malware payload (Mirai)", "value": "5ca9efd260fc215b4216d373187c20e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "9d9be857-a827-4f6b-8024-745780838af7", "comment": "Malware payload (Mirai)", "value": "837430f0ddb22d9b92ea5bd2ab6bb11a336143fe174f6b5d7919b0299fbded0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "be86924b-ebc5-432a-a43a-1f70678ce223", "comment": "Malware payload (Mirai)", "value": "e650476bdcd9c7f398957505f2bf976861061018", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079690, "uuid": "c277a7f8-5a6e-43cf-b84d-6e5549199eac", "comment": "Malware payload (Mirai)", "value": "0823a0455fcf37fad1172e6c4dd5a2c11275903bca118840695df5fa87c49bad2ae1864a2502a9b570b802e86e859e6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "c21473ab-9a62-4421-b70a-00b8cf220d65", "value": "T1B8E2F167D372E452CD782AF1F9A985CA2BBD4B6CD57B30B31A0157182E5A0439E2C8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "0f99d683-d06e-4205-9541-ed5ed89cbd47", "value": "768:2oiWiO031vpAPbrVWZK3XVGxm9Xw19q3UEL5I8:2orm1vpALgUJwILL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079690, "uuid": "635df7f9-f375-4ca3-8d03-29facc160a8f", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079690, "uuid": "7ef0c446-7de9-470b-abce-caac4b75fc49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079690, "uuid": "b9b04531-ab33-49b0-9657-6e2c4b419418", "value": "5ca9efd260fc215b4216d373187c20e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424b8478-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084644, "uuid": "b83668bb-7822-4bb3-8899-49f3fb213d16", "comment": "Malware payload", "value": "0c269fdee161558887d6d0a15306a368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084644, "uuid": "d7056a0b-ca49-48f7-8172-f34aa1118c7a", "comment": "Malware payload", "value": "8388aa093a9bcf92fe70e2f5e6e4864e4c7e757e0812c1acb4fc8b9bb48e90c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084644, "uuid": "6454035a-b51d-49a0-805a-8d64ed76e221", "comment": "Malware payload", "value": "4f1f341bc973792a731955b2df288432fee45f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084644, "uuid": "02c4696b-373b-431c-801a-a8916da3a18f", "comment": "Malware payload", "value": "2173272e2746570687e31853991418452e677cad768eebb823fed4ff7e1bf1a17900a903b00daa7969ef0c31df9b468c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084644, "uuid": "404d7129-5a8e-4313-9d63-376aa9edd5b3", "value": "T126931284586F520DB7A5E02314086CEBE9142FCB5EE1D6AAD633732E4C58F171CFE266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084644, "uuid": "a444995e-4de1-45c3-9c6d-53bca70c6245", "value": "908e67f8b0160bfd82132ad8738bb56b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084644, "uuid": "080a2c39-f139-4980-ad29-16a4e42010f0", "value": "1536:a7zfMMknJvVvwlTHavNbA8w9KxlO9Lc3Otp15wKwYPpLKA:ufMbJOZHaV7wdZcm19w6pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084644, "uuid": "350c854b-1f56-4883-934f-4439092c36db", "value": 97190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084644, "uuid": "9783a375-86ac-453d-a261-8ae3d37edc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084644, "uuid": "ae4cac1c-29b6-4f88-a7a8-eeb3887f7c24", "value": "Trojan.Autorun.ATA_virussign.com_0c269fdee161558887d6d0a15306a368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021f4bfa-4dc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694121473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121473, "uuid": "d82bc040-14b9-4a8e-b37a-cc8dd9aa037f", "comment": "Malware payload (MarsStealer)", "value": "d275962256d344f5862e5a576625b434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121473, "uuid": "d2106dd0-cd05-4f45-a178-0bbc09c8f6cf", "comment": "Malware payload (MarsStealer)", "value": "840c38013ced159fba2b422c5f279518b863f2a60f4d15c978250a3da05c08c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121473, "uuid": "b2eaf038-f75d-4701-b46f-4ff90535b5d7", "comment": "Malware payload (MarsStealer)", "value": "2c192a85009aab3ae1449abe4f77d5cd7a354c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121473, "uuid": "52b165a1-7e12-49a7-9a9f-66b5d5cd55e7", "comment": "Malware payload (MarsStealer)", "value": "6d73a8404303beb7c79c6383a42ff0ff49dccadbd17ca45b4db801a3073f9b15fa73580f4f035ebac059e1ccc3af9ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121473, "uuid": "07b60cca-7d84-45df-9366-81a85e800ec8", "value": "T11CF3E17F1D754A2FE7F09BFD4474B732C23CB77886091913F01B108A89A81E62356A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121473, "uuid": "bce098d6-711f-4ac1-b310-196d6c2fbfa2", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121473, "uuid": "dda38de3-52c1-43b0-bcbd-b760ae246d0c", "value": "3072:UPxx5S2LT2n6zYlwL73gBC/5UIJSp8Bb8EG:Axenblw3WIf8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694121473, "uuid": "ab6bec30-c344-4b04-8319-063fc79325a0", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694121473, "uuid": "b95fe38f-8f55-4898-a7d0-bd2f1511394e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121473, "uuid": "1f8ef918-e821-4b44-af56-2ed9f3caa913", "value": "OBS-Studio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbe7c13-4d48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694068638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068638, "uuid": "8c663ed2-a138-420f-b2a5-e6c321e2ebd1", "comment": "Malware payload (njrat)", "value": "af65d8835dd96eed372185bf51d9c08f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068638, "uuid": "a9070a51-83ed-4701-be20-ba2de54bb9d9", "comment": "Malware payload (njrat)", "value": "842a7606a22387e3e980d7d8dc89885462723c3a4dc30efef322fd1824d8b7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068638, "uuid": "44fb4a96-e72b-447c-a1ce-c973550ad213", "comment": "Malware payload (njrat)", "value": "c170322c287f75259316a2e44045c0cd40c9ea95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068638, "uuid": "7b92dc56-72de-470c-a21f-2b201b060b8f", "comment": "Malware payload (njrat)", "value": "265d96eb2c910bbbbacc1771a71fef1e3a09b25bff1c4dcd7f90fa88d90a734b1f75385162e5e05238aad50159440db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068638, "uuid": "b0ae3289-78b2-48f1-a33a-b23f87511426", "value": "T1DF032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068638, "uuid": "759aa76f-0bbf-4db1-b239-37fb0cccfe59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068638, "uuid": "d5ef1945-2fc9-4811-89b8-34ef34975fd7", "value": "384:Ie8vEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXZ:J87TZ38fvCv3E1c1rM+rMRa8Nu5rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068638, "uuid": "0ad89375-d80e-40a0-adb8-a4ace747b745", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068638, "uuid": "669218b3-6119-4357-9834-0e3ab095f502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068638, "uuid": "a4d952fa-0621-4921-9a09-102e50e58346", "value": "af65d8835dd96eed372185bf51d9c08f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd6d389-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103266, "uuid": "7a85fcc2-0653-4dde-b52d-f2ab00b79d20", "comment": "Malware payload (AgentTesla)", "value": "5e9beef695b147d5d97c046816ea05f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103266, "uuid": "51078708-5a6b-49a6-9446-ee0bc8587bb0", "comment": "Malware payload (AgentTesla)", "value": "8452659f0aed8f73bfa2a5010f7ed6c76bab50b695ee4aec97c0e1e275ae0ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103266, "uuid": "7fac296f-1d2c-4bf2-896e-cdbed0cc0b23", "comment": "Malware payload (AgentTesla)", "value": "3a31e3d58b1d795b6856c5d99efac31d6e449b29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103266, "uuid": "c3c57414-39ad-4280-8993-75719cfe0370", "comment": "Malware payload (AgentTesla)", "value": "cbbc7c899c15981f94897aac47495c0e3bf9bdaec25cdb34f5a0caa92119b6cd2f67f8d658c632b3ee98926a317259b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103266, "uuid": "ed5a0b6e-dbd7-4509-9d2e-d1a73971b1f2", "value": "T19C347386F68492ADCC18A3B07532DE7007167EABE974645E5ACD3E673FB74F20066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103266, "uuid": "3a6fc0bb-a599-4119-80ef-0d127d0d7793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103266, "uuid": "9e2f41bf-5a5d-4639-9119-136a1e9a4514", "value": "3072:Fft8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:FfOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103266, "uuid": "6b95ab0b-338e-4f84-bc62-540d523313d4", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103266, "uuid": "f868e2e8-b414-437a-94c3-3b1999d82309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103266, "uuid": "db98fa57-5561-4106-859f-8359cfae360f", "value": "FIYAT TALEBI N\u00b0DE2809 ACIL LUTFEN 230907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10119ced-4d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694089285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089285, "uuid": "cf6fed79-ecad-4af1-baf9-406ce49673d9", "comment": "Malware payload (RedLineStealer)", "value": "1890526a0685c83197503090a389d6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089285, "uuid": "2693fa3f-edb4-403d-8924-dd21f990b57b", "comment": "Malware payload (RedLineStealer)", "value": "8461000349e94a44c29b5350bb8cfbdc3ae3aaf3b849eddd4d697a7c83e4a00d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089285, "uuid": "9d638392-b0cb-42a2-bbae-3ad88fbda932", "comment": "Malware payload (RedLineStealer)", "value": "b6b90a1e99927cef162d0de3971c8afeddee7d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089285, "uuid": "c51a13bf-5ae0-4719-9e43-8d6c67884f5e", "comment": "Malware payload (RedLineStealer)", "value": "3e956ddb6df9470ebb32266fcf61875575859490c1b5fe25067845e0c25a97f725e7e97845baa6074d33f8e7263d6db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089285, "uuid": "a1bcbe3a-be24-4159-9b5f-594e28d62443", "value": "T1DCB4BE12D2A1B821D66786314E6AC2F42A6EF9E14F1577EB235DBAFF0D741E1C672300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089285, "uuid": "db8684c4-2944-4a6e-8cd5-93d6934323a0", "value": "6200f2b320af277fec49ce04b92f1379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089285, "uuid": "4a1864f8-7374-423b-ba2c-872d3f23dd2c", "value": "12288:hvm1yW9c+NB0p6LoaNR8t0e1J2DUlSrMh6yQN:hOQWl70p6at0e1/286ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089285, "uuid": "93537763-00ee-4c17-bb2d-130793c154d5", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089285, "uuid": "1fc42a32-322a-4b52-a433-408dfb0fc0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089285, "uuid": "bd95d459-e84b-4315-aa26-078dfe05a31f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbd79d6-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Floxif)", "timestamp": 1694084909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084909, "uuid": "3ba77233-80a1-4b5b-8a15-9644131ab734", "comment": "Malware payload (Floxif)", "value": "598218fa1ed2ce5084298795283feef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084909, "uuid": "7425bdfa-f6ab-4a53-b7ef-ef5358ce59f1", "comment": "Malware payload (Floxif)", "value": "8603a6629d84f5151f3c14463f58a86b24baff50280fa66cc26c086e3211b89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084909, "uuid": "7a19d322-eb5e-4d04-b90a-dea9e8bd5650", "comment": "Malware payload (Floxif)", "value": "bbd4b6719686cc040120910552a101dfce51373d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084909, "uuid": "f8fa3530-3fc3-4bbf-8b7b-6177c4734583", "comment": "Malware payload (Floxif)", "value": "27c7d7fa94663eff6110d2f1561e56e7bdbfac36928f28e4c0cff9e750849e022a81c02dea12763ddb9e3e924001ba3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084909, "uuid": "04077a02-6e77-470d-9fe6-ff0a80c89a90", "value": "T1FE356C16BE9E8D33C07B1A399D1B539858367E103E38996A27F11D0CEE797407D212AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084909, "uuid": "02333831-3f03-404d-ac79-3408435ab001", "value": "f6d256806748fe1d0cac1e9d242d34a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084909, "uuid": "cb905b75-18d0-4412-9155-88a7227024d4", "value": "24576:00Gsb6tY9Pk9PtknGeGPzwuktj8o6Su1Z8vc3OrEH74:0nsmtYW9PtNwJj8o6Cvcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084909, "uuid": "ba336771-176c-4a50-8d6a-d40145028ba8", "value": 1149895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084909, "uuid": "a8431064-7f6e-4cc7-ba70-6f69c152f7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084909, "uuid": "714421ca-fdcb-491d-b002-07b9f6abd426", "value": "Trojan.Hooker.ATA_virussign.com_598218fa1ed2ce5084298795283feef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1402fe43-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694111625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111625, "uuid": "55b11fa4-480a-4059-abb4-738085d05fc8", "comment": "Malware payload", "value": "ad08396b511fd4910636de0f1181ce45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111625, "uuid": "e8cccea7-3fc5-4392-847a-fe1a748bae84", "comment": "Malware payload", "value": "87041f023c4ed73aadb8f37c91a137bd1cc7d81772135686e2cde6c134d622f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111625, "uuid": "1b14d264-9ed5-48ef-b287-a7805297b544", "comment": "Malware payload", "value": "ea0bd2512ccdfd4064c956642a504c153d908ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111625, "uuid": "3f154193-670c-4c0f-a3ed-f68848b2b7c2", "comment": "Malware payload", "value": "ae91c9894c8225e7958c4f83b6f720da81a8f94b20cf118fd8d3ee0a8e282578f457c519c90fd1433b7e1440b28b4a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111625, "uuid": "e94de781-d76a-4054-a795-6f06b95c7e7a", "value": "T1D416187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111625, "uuid": "9d2fea0e-a9cf-46b6-9614-627de21c878e", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111625, "uuid": "bfb5402f-8870-4dfc-9234-9950e66432f5", "value": "49152:Ogh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcW2jXNO:Ea71faO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111625, "uuid": "fa94c00a-d02b-405f-a3c8-8d19045c6d9c", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111625, "uuid": "d0d7e3bd-33ad-4b45-b6da-731dda14513d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111625, "uuid": "2e4623df-1ed5-48f8-b57f-02e2c9712361", "value": "SecuriteInfo.com.Trojan.Packed2.45650.9634.19580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef143c84-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694090088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090088, "uuid": "a0c1693e-7525-4336-9aff-f7ae3386a643", "comment": "Malware payload", "value": "4d87df4053fde300245ea19cd0181902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090088, "uuid": "b75515e7-dd47-46a6-9923-dd54d15b9a27", "comment": "Malware payload", "value": "8734f7745340021327d964f3571085469731bee8678a4c919f07faec8689a574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090088, "uuid": "2534c2dc-6adc-4926-87f9-f9ef7480c2f7", "comment": "Malware payload", "value": "95de5cabeaa198bc4ee8842ae47dbce711ce8f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090088, "uuid": "86e700d8-ef2a-4a29-8626-ba1ef2c94275", "comment": "Malware payload", "value": "3e40cea2a346d06675f60c2ed67e3f5507deb98e26b5ed6bb4deb646574606c03e836d3463351ba284cd64a0218c9152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090088, "uuid": "a4ce7a0d-6b8e-4f43-b994-0e0f3cc3a16d", "value": "T1B016187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090088, "uuid": "55756d90-3c0a-4f35-a2c7-5ba9275848d1", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090088, "uuid": "65adb511-a83a-4e81-b865-922862ce1ccb", "value": "49152:+gh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWbjXNO:Ua71fTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090088, "uuid": "40f302bb-8a0a-4047-88b5-511a0010e79c", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090088, "uuid": "870e6b4d-f7e5-4e36-b3fe-48ab4409fdb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090088, "uuid": "cd3e3f15-6f83-4e42-bde6-69f9b88db181", "value": "SecuriteInfo.com.Trojan.Win64.Delf.21908.24842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b56781-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085721, "uuid": "a530722c-983d-4d3a-abb8-25f3250de598", "comment": "Malware payload", "value": "7a9122af8213bb06db806a5319fa2464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085721, "uuid": "b4f1f77b-4330-4bc8-ae07-e0462b206c2e", "comment": "Malware payload", "value": "878e975671aa175d43a4beec85c24006f219bcb015fe9c2cbb0023164af97a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085721, "uuid": "e8a2463b-c93b-4bdf-9765-d64fb06b6fa4", "comment": "Malware payload", "value": "9587d56e1b2db9fdc8d2448d599554573f1c809e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085721, "uuid": "88fafd0e-ea5e-453f-8491-f89009628719", "comment": "Malware payload", "value": "b7d5eea9131c2219ffadb9f55bad7845f204a5758715ce7e833d9f67edaed8e8947789353246cea0f90146200d9cc11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085721, "uuid": "47f03afd-14d4-4990-b93e-022626eaecb4", "value": "T117A34892778245F6EAD38D7548F7322FCB356A244B20D8D7C76859079DA21C0CF3A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085721, "uuid": "eb217aef-2c00-4389-b390-f9b5c1b5c53b", "value": "e3137de433c89cd906f533b6916e101f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085721, "uuid": "13551f60-6222-4f36-b98b-a18953c9a5f0", "value": "1536:oW87lXzSzSESMO04b87lXuPVdNZ8+dRW1e5xuLP80u9YWwmYx+0o7b4bvv3/Ju:oazBSMEFdHn+p9AYWwme+jbo3v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085721, "uuid": "26c12ea1-0e5b-41bc-a745-05f4c76fad41", "value": 104763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085721, "uuid": "51c2a970-4f3f-4a0d-9b4b-10fa3f524f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085721, "uuid": "12da8cdd-d5c6-4fb5-8880-06492c6d4e38", "value": "iiii.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0908f15-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694085286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085286, "uuid": "e8393d22-f909-4d84-9b72-27ac42768535", "comment": "Malware payload (Cosmu)", "value": "297bd6764cdf9879de1854af0ab60c7e", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085286, "uuid": "0fa3e095-2f1d-49f0-a413-ea069b5f07ab", "comment": "Malware payload (Cosmu)", "value": "890733c28502c96a8081f995f7a78d390aa0f640f838a7d742b8c6c25256b70e", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085286, "uuid": "5e3ad85c-6967-4a82-adea-4f9a6bae593e", "comment": "Malware payload (Cosmu)", "value": "6c256c4e63a5c975db6f58cb06d52638aa547f07", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085286, "uuid": "be687d4c-583a-48a1-a0e2-654f1579607d", "comment": "Malware payload (Cosmu)", "value": "2b8bf2161e460103cec0e8267b2e78be2118604d9212af865d212438234a5c7eb56cd8549a55d24b98bbcecc303ff82e", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085286, "uuid": "1d796eef-9480-4e31-895d-cf851aa9d728", "value": "T161947002E676FC1FF1FFF3F0D52B31182E92DD59AE80D8019DF0918A92A7A6159592C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085286, "uuid": "15a8090b-72e7-48f5-bfaf-3474ac427f24", "value": "8abecba2211e61763c4c9ffcaa13369e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085286, "uuid": "935a226c-c822-4213-b5d4-67455fb7fe8a", "value": "6144:RqlIyFESWu0SWuiF0oZoAwq1afhcD5sMji6cGgOgpfnf0fgfnf0fa:tyMFtwIVgOgpfnf0fgfnf0fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085286, "uuid": "573b6d74-56d4-422f-abbd-df9c04acc811", "value": 416096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085286, "uuid": "f4fa9f4b-340b-4fac-8721-64d9bc1c6307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085286, "uuid": "bb095aac-ee89-4df7-8118-5dc437be618c", "value": "Trojan.Danger.ATA_virussign.com_297bd6764cdf9879de1854af0ab60c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad18dc4-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096040, "uuid": "ba8e235d-dae0-4da6-a71d-fe4086adca2f", "comment": "Malware payload", "value": "ef4bdf745ff68388a44cff6a1910be6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096040, "uuid": "4368a550-dc94-4ae3-8beb-583dad43ff4d", "comment": "Malware payload", "value": "8a74c9a668ec70497e1b3efc316d0bb4c9ea613848f35a66bffc06d23162e0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096040, "uuid": "ada50b2a-f0c1-4c18-a0b6-4e3cba869b80", "comment": "Malware payload", "value": "af2d14c9954e70d981b66b501ad9e615ca79e486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096040, "uuid": "c5fa8283-d720-40d6-a14d-512da611008a", "comment": "Malware payload", "value": "ad08ae4d56432adc9b320323164715d3940ab3499dff4b9a430fe4a0fd608e7b0f10168e603fa01dac049dbcf45f52aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096040, "uuid": "238905f0-9abc-4f1a-8fae-442850182608", "value": "T1E904C56C364BA97EC96F483D9C600CD4767CACA31246A7079C8EF4E8793B7819B051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096040, "uuid": "bd1a1f5d-ec66-4802-b0f1-408df8cdc997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096040, "uuid": "2dffb214-c0e6-4c5d-8721-f520ad97e4f3", "value": "3072:Iau5tcrwI04STjQcOJ1Aj0cl6AUP/RE0yjHX8ouDJY8e8hl:Ia3wI04STjQ9cjUP/RE0xouD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096040, "uuid": "4a6f0e2e-1aa4-42ae-a238-4465c20b6034", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096040, "uuid": "c2155cb6-0c2c-4345-90d3-08d3bce51512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096040, "uuid": "3f989b1e-e8b4-4d5f-ab01-dc5c5f7b40b2", "value": "decode_b80e5d4e207f32e6e0f8ed8521c2d6c88d5ce79f5306925e667b79f08cfdcef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d9a3ae-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085805, "uuid": "f125c908-bcca-4629-a1e7-5cf8c24645ae", "comment": "Malware payload", "value": "e986dd965d456184f078647c3ee4216b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085805, "uuid": "c51c7536-e8bd-43c7-939f-14ab89c5e872", "comment": "Malware payload", "value": "8a7cfefb668c044b4740d0d5a1616daa472da652bc1d127955b220b937d712b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085805, "uuid": "33d050a2-e0ce-45de-8a17-c0237b6fa0f7", "comment": "Malware payload", "value": "46fef5bce1e3814c6626c1492b1c0f780d67eca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085805, "uuid": "a7b62803-eb47-4560-8c84-4fc2ab50bb15", "comment": "Malware payload", "value": "31f198787e479d7d21afe4836273513fefa2e752aac5641bd883dc4c94e692949a512770db1fdcde196e7da4bf757501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085805, "uuid": "045bad25-a53c-4d0c-a9d7-c2bf59ae637c", "value": "T16EF38E02A7E84136E9F21BB01CFA13830B3ABCB2AE75935F2755599A0C726C4D931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085805, "uuid": "e792f177-6e9d-44a4-818b-0c5ee5c77a16", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085805, "uuid": "c22c47b7-2dcf-4f75-9b53-be2124aec505", "value": "3072:5DFRQGCIIm1xd5GWp1icKAArDZz4N9GhbkrNEk4fH7YEg8OP:NQGCIImrp0yN90QE7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085805, "uuid": "9d7a93d4-7b6f-4f1d-be08-5686ab71fe22", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085805, "uuid": "359ea1cd-b5b7-482e-ad99-afddd7e4477c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085805, "uuid": "9115385b-934c-452e-80b9-717923fb8859", "value": "flucC2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efab7b60-4d2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694056588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056588, "uuid": "6bba6312-dfc1-4a18-97d8-1afc8bb64d04", "comment": "Malware payload (Amadey)", "value": "adc6f513f7fa107969e5d836a74f38b4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056588, "uuid": "453132ae-722b-40cf-8d90-6cfccbee69e9", "comment": "Malware payload (Amadey)", "value": "8aa36714a28693b22e5ca090e3c647c8d71e1214f6a497407f92d9923bee8d29", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056588, "uuid": "44a13434-09f9-4c49-9574-6c00bc04f688", "comment": "Malware payload (Amadey)", "value": "140c369c273c23274c4f2420e22185574b7c461e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056588, "uuid": "e41e590f-41ce-472a-a8c4-fcd18aeac4d4", "comment": "Malware payload (Amadey)", "value": "52af74d1d365c21da1ea9b0874287e805c6b8ac6970ca53a8bba9d849b60ecdd07f3b02150c69a16f7bbd9537427906f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056588, "uuid": "1b686f9d-54c6-40f6-8db6-bbb798828857", "value": "T17724F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056588, "uuid": "dd805c24-0c62-40e6-b2fb-187fdb3990a8", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056588, "uuid": "6a3140cc-baa4-4ef4-8b55-9735e1d6731e", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694056588, "uuid": "d7d3e7e7-0937-4910-bcba-7966776b124f", "value": 225722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694056588, "uuid": "7c8e1f1b-897c-41f0-b08f-f9d151eda8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056588, "uuid": "c193dc6d-6873-4d85-bce4-e5529fe5fca3", "value": "adc6f513f7fa107969e5d836a74f38b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd131ab6-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127854, "uuid": "f1bfe52d-bfbf-405b-9bcc-ea2aa4f32e8d", "comment": "Malware payload", "value": "0ead9a3f8f53533bf6e55c6cfbc2cd9b", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127854, "uuid": "c72661b1-7275-4185-854d-dd733d46d716", "comment": "Malware payload", "value": "8ad942b7da27e21c1d4533b8cb1e888fbf2b3ecaaecd2a0e797f17fd93efbc7e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127854, "uuid": "5d1fd473-b4e2-4ea7-a423-aff229cdfcd5", "comment": "Malware payload", "value": "140cc070052f3f1fe958cdf287c8850743e9c81a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127854, "uuid": "1b327477-a027-4b77-9311-3b38b19b82da", "comment": "Malware payload", "value": "b6385220ffd21ec6ed7883cd20e7cca8c9c63a5609c2074887ddbf07b35b273144572167f35e57283880a76c262cc162", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127854, "uuid": "5518ea9a-e064-448a-b11f-6b9c45d2eccc", "value": "T1D8413C26B2F9071CE3B15A3744B5AE138A377809E827CB0E71512DAD18649CC9865F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127854, "uuid": "129b95d9-1f07-4181-b1eb-1d677a7c9bea", "value": "24:8N/lXZsxEMvnN/ZpyAzk8WfyMUIsyMb+UHKb+/4Y5ws4flBspEQeyTtTVab/2XT8:8TrMjtIYgLflBsiQBab2j7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127854, "uuid": "04c0e39f-f7c8-45da-995b-fb245fe9305c", "value": 2205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127854, "uuid": "6f909baa-0444-43eb-8ee1-01f8e32acfe0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127854, "uuid": "3713cd36-4741-4d9e-9187-8c040ba13038", "value": "client_upd.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510b9ce9-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694102708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102708, "uuid": "6ab37a4d-b483-4f4b-b710-bbbdb2100421", "comment": "Malware payload", "value": "ea3a037b84dcabc1543988ea6a1d8e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102708, "uuid": "973663af-6017-40d4-8796-9a8f890a2a6d", "comment": "Malware payload", "value": "8b12ce2fd110656e63507a0293bc27c36f75030a8ad95543ce04d71dc498b3b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102708, "uuid": "6dcba4f1-22eb-48ac-a72d-041818bc156b", "comment": "Malware payload", "value": "f1981389f6a3113aef45c1b7ca8adb1ee3e36547", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102708, "uuid": "ee083fd6-2d51-448c-8652-beb522eae026", "comment": "Malware payload", "value": "65dbcf474a26913e569356e7c2c8b2b3061bb93857fcd6c907217a3cb6141826dd719f70ad56c592116d54c7a4e99b8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102708, "uuid": "621ee761-33da-4026-89ed-ff4789fc9d08", "value": "T19714B61E6E228F7DF378873047B74A35AB6923D627E1D644E1ACD1105F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102708, "uuid": "da1c314a-0767-4126-a42e-6c8843271289", "value": "6144:3HSxR8YvesnfGsqNaSeoR5vQNu7wMYN7+lQ:3yxR5mpuCQh+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102708, "uuid": "3efcbd3f-a851-4b3c-b91b-b03837ff7a34", "value": 207736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102708, "uuid": "bbea7d56-1a21-40aa-86e7-3f5809d7580c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102708, "uuid": "10d9d28c-a997-4ad0-865e-2a43b4267a20", "value": "ea3a037b84dcabc1543988ea6a1d8e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dca380-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075688, "uuid": "c55ccbac-4d6d-4506-8cb6-5e9f69debf1c", "comment": "Malware payload (ConnectWise)", "value": "80811aa9ad163e8c4adeeffccabf9922", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075688, "uuid": "7b7ff2a9-8d03-47ad-bcdf-f570b52f68bf", "comment": "Malware payload (ConnectWise)", "value": "8b7ea99547495de91bee699054f3640968b7ea3df80b6dee52f19b06ee601b07", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075688, "uuid": "2c58ccc9-8caa-4fa8-bbb3-d3077d6df8a8", "comment": "Malware payload (ConnectWise)", "value": "875d50004a0599a6cc57a8806a8988efd3ee47d2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075688, "uuid": "c006a0d2-4319-4a1e-9646-d94f0995a278", "comment": "Malware payload (ConnectWise)", "value": "c3421858cc42480b19e921bbae8791c386de7ed9f116748e1dbb75c286cc0c42f0aa0d09231af58cb816c303120b8f8e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075688, "uuid": "06f77bfd-562d-4e04-9d54-be3975aad7a0", "value": "T11A835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075688, "uuid": "8a504606-8e23-40a9-850d-b998895ff6fd", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075688, "uuid": "36dbe31d-f4bf-4e85-8e08-015fb97e0522", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3gk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075688, "uuid": "21ad8f67-d3fe-49c1-a314-c10b07740893", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075688, "uuid": "812a5e81-c8ba-43ec-a9c8-2e3715b52ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075688, "uuid": "8b7fe795-077e-4ca9-807a-6275b07e5c21", "value": "80811aa9ad163e8c4adeeffccabf9922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9205450-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694080629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080629, "uuid": "d1271d5b-a3af-4efc-96b5-a01ab7b2cf7b", "comment": "Malware payload (AgentTesla)", "value": "0a99bef1f2a5eb54ffb6b8f76a1d0db6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080629, "uuid": "2f83447b-0e4d-4918-86f7-4eb2039057c0", "comment": "Malware payload (AgentTesla)", "value": "8b8a50ff0f688234a073d3cb6df4727676627c428f197d7281a79e0fa3e0062d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080629, "uuid": "07500215-d710-47a0-8343-e027e5a36fbe", "comment": "Malware payload (AgentTesla)", "value": "a09d05dd81373e36906aa61bee37309dedcf0ce9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080629, "uuid": "3b6aebc4-9195-4560-876c-350ac53d54a6", "comment": "Malware payload (AgentTesla)", "value": "18291f054026cc20e80ed7f32e05e3df1f815dc4834d8adc6a41cef43595a347a0cee5f678fae0e2ef0169f58c6a0383", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080629, "uuid": "6157e12d-748b-4768-bf37-293fcc263276", "value": "T1BB45236DFC983955DC65F4FF10B46CD49AD214F8012CA7C47AE1A3DA2F221A4CBA62B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080629, "uuid": "72586eab-8df5-4ffd-a8df-9b0f2a142c62", "value": "12288:Pyjo80WHk90IoCR4rGHirkvpYRQ3Nz2+ZcYq1TKBlm:PAodWHIoLkpb3Nq++hKBlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080629, "uuid": "545a9f63-054e-4113-87f7-fdc16463f910", "value": 1226406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080629, "uuid": "783bbec7-fb84-442c-a117-d4aa01ce8cda", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080629, "uuid": "4ece0aaa-9d16-4941-a5df-77c90740a215", "value": "Rendel\u00e9s.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7c00f0-4d67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694081928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081928, "uuid": "6ce2bbcc-6fec-4cd5-9d0a-d1dce03ea533", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7e837bb9822a54d69a313b773004d686", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081928, "uuid": "a3317bff-5bc1-47e8-ada6-a45d53e63297", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8be1d9004e4ffad4035fa973d6d6508835762adf097a7f4362039b11b5d41122", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081928, "uuid": "3cf02f88-17cd-4926-8d00-c4c28038a08b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0c91f6925fbb4f864e9b5d7130d5223529689127", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081928, "uuid": "916398fd-41ce-4a6b-b87d-5a297f2e4433", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "58cf8bfb6c1e9c9e196b88420bb89d39600232215337e738ba0720dd7e190ecc4c69adb57776a510b21156185ba86710", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081928, "uuid": "f9a65d8f-88b5-44bf-9efb-6687c08bd9dc", "value": "T13435332392517A71E2639CF86C4DC539467BBDA10630980C5B6D2E4FAF2FAB38C467D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081928, "uuid": "5988a5ea-0008-4cad-a020-9886e8956e45", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081928, "uuid": "971f5ed7-1692-4a05-96d8-a3e20278e252", "value": "24576:/I39dEO8wRmwKfQw3hcZX39O9Wv4Msog8d7SG718hgebVKoyInpD:/6dmwcQw3hUtoWvrsoj5kVbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081928, "uuid": "cf3e92f1-120b-4e21-b09e-a2efcb4c1343", "value": 1126192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081928, "uuid": "eaeec217-9758-40b7-8331-8e854328c768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081928, "uuid": "0a3231fe-7181-4875-96b4-9fb36ac7dc83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc93d40-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102733, "uuid": "5719a4a9-3ce4-42ff-9322-965c718a0c64", "comment": "Malware payload (Mirai)", "value": "3843a07e49286ba8cccbd2f28386e792", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102733, "uuid": "0554e06b-5bbc-4fd9-91a6-ef552990171e", "comment": "Malware payload (Mirai)", "value": "8c06a9d68620b18b55940a17d2bd46ab18475ad9a00f8f2ce50b8db754b43e3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102733, "uuid": "46730f0b-b73f-45c3-8fd1-c8081ccb79d9", "comment": "Malware payload (Mirai)", "value": "e66b1457062935e8137166f3520bce337d6cd130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102733, "uuid": "77fe29dd-393d-4f11-a1fa-13b0475e4c91", "comment": "Malware payload (Mirai)", "value": "29a9b312c7cd4683f7ab65acbbba6793590d020d306380c9364821206269a57c787d9fa619fca529c699380302af9e66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102733, "uuid": "bfd8901d-b23f-4c88-b51d-b66812ebb315", "value": "T13CC2E1A0E1B62E95F7766E602B65D2C177B04E9EBB77CC923958AF0804A32174705BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102733, "uuid": "707bb2c3-cf84-412b-becd-d84d445f1a30", "value": "768:lG959yM0HWubJsWDYcGSYX4uVcqgw09S0i:tM0HRJswYcGSW4u+qgw09S0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102733, "uuid": "13b8ce37-08af-4f42-9984-1440a466cefa", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102733, "uuid": "98c2c1f8-d604-4b5d-bad0-39bcae4612ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102733, "uuid": "47c92cd9-a496-4711-ad3d-72eb745ccd08", "value": "3843a07e49286ba8cccbd2f28386e792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142cfb71-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103035, "uuid": "63964d21-1da6-497d-9054-cf7daca07709", "comment": "Malware payload (Mirai)", "value": "5b88adf49c7316c8ce92c9b1b900b856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103035, "uuid": "28575ad8-be08-4c4e-bd66-7ecc18605293", "comment": "Malware payload (Mirai)", "value": "8d28542e1360e8921a6ca9ee292f6e2075aa798e648de1b701fa74fe21b7b969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103035, "uuid": "ffca9f33-e38f-47a0-ae66-9a7258d4baff", "comment": "Malware payload (Mirai)", "value": "3cb9bb288d372beff1bea21102a6f375de0b4923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103035, "uuid": "e3ca6cfd-d884-42dc-8616-e698cdec5d77", "comment": "Malware payload (Mirai)", "value": "5f7a892c9a9eac0f144afdfb3226917a2e55137da3d6ae9751483d0fd20142536c3f39e79dde5dc74cfe0269ca89bcde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103035, "uuid": "63d2ee8e-f5e7-4ec8-a065-7636520f5970", "value": "T1BE539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103035, "uuid": "9fd3893e-aeed-4ae4-9802-43dd337e6465", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103035, "uuid": "2d10e483-4618-4c18-af3b-a60a70c603f6", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103035, "uuid": "c7d57662-f6e3-4a28-a089-132cfb08178e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103035, "uuid": "4d108ec8-2b36-4eca-b97b-74c8c4dae0ea", "value": "5b88adf49c7316c8ce92c9b1b900b856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df72ed3-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085093, "uuid": "09d75556-65cf-484d-b153-0077bc30a123", "comment": "Malware payload", "value": "8dc36af3c522d8f5ab62489d2acf0471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085093, "uuid": "99c89e62-1fd2-4244-aca3-7927f5966112", "comment": "Malware payload", "value": "8d6539e5a0566999461b6f3f1f80bbbff0dbfb5eb2662951d68519e07194e61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085093, "uuid": "8c244679-5227-41a7-bf3b-3618b2b61764", "comment": "Malware payload", "value": "6fa0a2aa63d01d7238a6a580482eb9fd5921da7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085093, "uuid": "9e5798e1-dd6e-4352-9ffa-49d73bb46bee", "comment": "Malware payload", "value": "9f6623782a8c3f9d30bcc80261541fa5819f655b5f3e27291badaca879f37adec88268e1c18747f46b689bc593ae7ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085093, "uuid": "4ffdb63b-fb66-4bb5-98aa-731828d80ad3", "value": "T1B0148D4A3D8596B4C44D013A087BA3AB27A23C2185DDD642FD80B7FF25BD6CCF62571A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085093, "uuid": "0967fea8-a492-4759-a300-9057751d32cc", "value": "c2ccab7daa22ec9432d3a0a885f4d18b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085093, "uuid": "16a2aa00-3e67-4aaf-ad76-82ec6cb78267", "value": "6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOa:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085093, "uuid": "9bd1e270-30ef-4cd5-bd29-63e62a641fb5", "value": 200108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085093, "uuid": "9c6fc80a-1bab-48fa-9b97-102627a45369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085093, "uuid": "21a8326d-062b-48ed-b67d-745025950797", "value": "Virus.Hijack.ATA_virussign.com_8dc36af3c522d8f5ab62489d2acf0471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591679bc-4d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694050323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050323, "uuid": "fee26dee-4e9c-431e-a48f-57e7a6f0ff97", "comment": "Malware payload (njrat)", "value": "128ca1f542cdbcbe29c51a0c73c58d81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050323, "uuid": "0e6357a6-e5bf-4047-8959-82a5d02c225b", "comment": "Malware payload (njrat)", "value": "8d6ad3743b91bdb362b05eddf7d54644cf7f160b4eabedd71550dc20a4220708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050323, "uuid": "206ddfd0-3847-44cd-b2da-1b5913a136ec", "comment": "Malware payload (njrat)", "value": "c75613067bc8a754e3a644df36483fe96753f48f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050323, "uuid": "10a01fcb-04f7-49b3-aa0f-685b8c95952d", "comment": "Malware payload (njrat)", "value": "69f492494a1e560d46e49cfe576a72ded69c415dcc569b8d2813eb875cb3c1a89383848d561365af4e9ac412e0983437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050323, "uuid": "632ceafa-2fce-45b1-bdff-f393659232a4", "value": "T11B83AE46BBA088F1CC3C0BB8CC1592144276761329F69A66ADD5098DDD77FC22D3C5FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050323, "uuid": "5f796e95-5659-4094-ba2c-baf28d1391c4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050323, "uuid": "d015cba9-a58a-4d27-a3f2-adf15c0cde63", "value": "1536:9xqjQ+P04wsmJCR+sdV+RWuHPGieNR5VAOS0VP:wr85CUsdc0biC5V/lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694050323, "uuid": "84f4e94d-5022-4b02-8faf-d02bf73651c1", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694050323, "uuid": "7f8ebb0a-ff2a-4831-8e4e-80390fc80882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050323, "uuid": "4b723421-51d4-4b49-88c1-fa534a0e437e", "value": "128ca1f542cdbcbe29c51a0c73c58d81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896efe08-4d1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694049975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049975, "uuid": "fd594260-ddb8-4759-8f95-0be6d10a09b0", "comment": "Malware payload (RedLineStealer)", "value": "f35bfb8f9513be3e302b613c057035cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049975, "uuid": "f1a60406-eaf2-488b-ac43-59138ecd2f7f", "comment": "Malware payload (RedLineStealer)", "value": "8da07992b7f4a4d56456a83745e1792d276780bd32eb00efb08a4072c88889e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049975, "uuid": "432068c5-a558-4e07-b835-6ad8c8c5dc74", "comment": "Malware payload (RedLineStealer)", "value": "6c10375495b8d6af1d5fc35115973b90dbf188bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049975, "uuid": "8dbd35b6-1c4b-418f-b194-d55ad21c76e7", "comment": "Malware payload (RedLineStealer)", "value": "35af39e8198001c1fa1d838482635d2f8f51ad7789e244a90cd6abe9ea1ddbf464c7e6f06c4c0bf25d9698cb53867732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049975, "uuid": "0b9004f0-b7e8-4d06-a9bb-80f5b67c74c9", "value": "T14EE41203BBE45533EEB9273158F341D31A36BD519A78966B2B42980E4CB01D4B876B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049975, "uuid": "30742fde-45a8-4c07-8bec-40152584f213", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049975, "uuid": "5b6ea606-3584-4051-b80c-3f11a27d3adf", "value": "12288:4Mrvy90n+hMEoEbabM78C17V5Py0jBIa6YPXNBWFTtk8fXUzwNDDmfb3y:Hys+hzdbkMBy0pHeFq8fUzMOfzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694049975, "uuid": "1a3a82e2-484f-49c3-b8e1-06ed7438e916", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694049975, "uuid": "238b99ac-e51a-445f-8aca-1ee78101bec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049975, "uuid": "e05cb6ee-89cb-4583-8bb0-d2ca174e2751", "value": "8da07992b7f4a4d56456a83745e1792d276780bd32eb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0e5ea5-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052393, "uuid": "2ba8daa4-9499-4af9-ac31-347f99029181", "comment": "Malware payload (Amadey)", "value": "232ff63aa3613401c26e7eace2a35af0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052393, "uuid": "9e7d03d8-c508-44b2-a193-17e57461b0f1", "comment": "Malware payload (Amadey)", "value": "8eb0a3bae0dd4f7ee1556176e1f575c155df2f24f2b50095f6e27a0daddf6643", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052393, "uuid": "5518ad99-d726-4de3-9163-928a116725f2", "comment": "Malware payload (Amadey)", "value": "f5be36ca0baf718fc9468a43cfabeaf41dea313a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052393, "uuid": "34f43c5c-7f41-4555-8dbf-60802b670d86", "comment": "Malware payload (Amadey)", "value": "e16b61c1114ae7e4d2430a9b1b1671e7180d3f6a348d23b5cd1ba5f9565ce5f554a49308aa92afc3ef3a7ce6b5c592bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052393, "uuid": "eecb1a0b-7791-435f-9ecc-bbe0c87f10aa", "value": "T13B24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052393, "uuid": "a32b8417-380d-4916-b1c4-5483c5aa5086", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052393, "uuid": "3bd84c51-bd2b-4b4f-b955-0bac1dc86e25", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052393, "uuid": "ce6e58cf-da1c-4fa5-a71f-20b32b882300", "value": 225662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052393, "uuid": "ad347c12-160a-4a2e-a4d1-7fde6954d0bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052393, "uuid": "4396ecbc-1f29-4d55-80e5-d500b4f0be29", "value": "232ff63aa3613401c26e7eace2a35af0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e4dba-4d4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694070389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070389, "uuid": "bc509251-9d08-4bd5-9067-17736b082873", "comment": "Malware payload (Amadey)", "value": "25a464da41ec79f8cc62ae1cb6bde9e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070389, "uuid": "05c7bd01-8369-4395-840f-56b2afe3a357", "comment": "Malware payload (Amadey)", "value": "8ebd0c5a73eb18d5542b5fa3571e286f39098e20e5d265caef203034795defaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070389, "uuid": "be3c775f-44ce-4ecb-a3e3-c494ae078fd0", "comment": "Malware payload (Amadey)", "value": "6d387eb332a58f02c24a7cf358a5995c37856709", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070389, "uuid": "8da532b9-31d5-4390-ab16-deee1c7e8e77", "comment": "Malware payload (Amadey)", "value": "d358c4133067c776b5ff6b5567d359147f872e2967f43a32a5d3291071f5235151e89393f71f8fbd861447d554be552b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070389, "uuid": "ddd12e8c-4d79-4434-96ec-c96b8885254a", "value": "T1B524F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070389, "uuid": "8a5475bf-f6be-419d-8f78-d1b4f15062b9", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070389, "uuid": "fb67f056-82eb-477b-ae62-9dc028801837", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694070389, "uuid": "c71b38f0-53d8-4eed-b28d-62c11ce30ab4", "value": 225854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694070389, "uuid": "2002f1d3-d623-423a-a891-c6fa18b22bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070389, "uuid": "895377ce-cda7-4f27-a894-47c2af6e4fc9", "value": "25a464da41ec79f8cc62ae1cb6bde9e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e736788e-4dac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694111550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111550, "uuid": "3d96971b-1b73-47aa-94e5-35a67b25b3bc", "comment": "Malware payload", "value": "dafe793068e0ce524e0cf3c6f88a3067", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111550, "uuid": "80bc893e-26e1-4613-b78b-d4d4f83a5e2d", "comment": "Malware payload", "value": "8f5fa78c2b92c3f4b0ce7ae1b4adca6e895d6bf32e3c11a8a604ca48bbdab112", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111550, "uuid": "f2f940cc-6bb9-469d-848b-7d676a361d79", "comment": "Malware payload", "value": "4beb0a94342758c6c6d74d569aac46533762027d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111550, "uuid": "d7f58044-d4b6-4965-973c-b8ae3ec36e01", "comment": "Malware payload", "value": "3767e827d868198adeb7687ada0522638dd155b89aac46583d4d6658c1a486ca2d5b0f87c5a1aa967138a9a16d2a5444", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111550, "uuid": "f7124b74-a49d-4f08-9102-977addc9a397", "value": "T13521360429DA1B21D37BBB3B84BA831699673893FC72CF1D0550858C291AB11EDB5F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111550, "uuid": "c32b238e-7d2a-44b1-8227-676508b1b88e", "value": "24:8wLJtnyUlVefRXcmlz3Lo9bp8DEt+kI4I0W5/2lC:8ulmxbabSgI/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111550, "uuid": "74a9d568-8edc-4e8a-ad89-897cbbb7fff1", "value": 1194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111550, "uuid": "a2a6b44a-7b9f-4245-8b36-6b27e52c9dcb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111550, "uuid": "d3bdedb6-775f-4cd3-aa89-e49107d6835d", "value": "416.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d47bde3-4d33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694059296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059296, "uuid": "37c47b21-0c86-49bd-a0c8-ed3c30cd6e18", "comment": "Malware payload (AgentTesla)", "value": "5c2b9063897b742f636bbed0c5dc7884", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059296, "uuid": "406f23a4-7b9e-4cb0-8385-1ec5e57974fc", "comment": "Malware payload (AgentTesla)", "value": "8f6adbbbaf0b3300c19c11245feda8a509e65af72091eccb5d5009635986ebde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059296, "uuid": "b50a00dd-a0c5-4a00-9c47-7adaadfa888c", "comment": "Malware payload (AgentTesla)", "value": "3404313219eee130dd02c51dca53fb9beae3d51a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694059296, "uuid": "473f0a1d-56d7-40b6-8c87-b717f8026b25", "comment": "Malware payload (AgentTesla)", "value": "cf78c2f05620dede23d19d9c16f144d8ffdfaf4625684e7774ce736ea4b41265a0728ab15a2a053af3c75ee930f7880c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059296, "uuid": "bb589048-7f7f-4d6a-907b-ffe48d006a3e", "value": "T18423152DC34F42A9CF525377AB1B5E5502BCBA3EB34452B1346C833533EE82D95262B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059296, "uuid": "488e68db-e2fa-4fc4-80af-6c912b3cfd09", "value": "768:kwAbZSibMX9gRWj29gYbYbr6xoC6tenAHi:kwAlR+YbYbr6WCSeAHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694059296, "uuid": "3684c404-3dee-4cb7-b0dc-08905f6ab43d", "value": 47807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694059296, "uuid": "07750432-c83a-4c9b-9148-2027ecdc52fe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694059296, "uuid": "1dac329d-54a3-4d82-b895-e2786f5218e7", "value": "5c2b9063897b742f636bbed0c5dc7884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac45e9c-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1694075612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "1dd4d9ff-39ed-48aa-95ec-239a040ecc21", "comment": "Malware payload (SystemBC)", "value": "8be029b88548450edb5e6b65a60cbfc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "08a6b4fa-6e2d-4425-9fe9-642c29751663", "comment": "Malware payload (SystemBC)", "value": "8f703dbe94ad3c9bfee41a6b920cd7765f0a948cae9bdf196b080253411a5d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "08b1145d-a2a3-4dbb-b648-a22754ca9c01", "comment": "Malware payload (SystemBC)", "value": "59d11404e51389f8bbadbd32cfdc574834fa1be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "b6f469cb-3b7f-49fe-9849-bd20a708e50f", "comment": "Malware payload (SystemBC)", "value": "f1bfc3b75accb16be0462040e8393327d63620a115d39d883704e45254bf69fe5a54dd4a564346725be7b10dd7d04a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "60a257b5-afcd-4da6-99d7-9b7de3312644", "value": "T191C44A70E39A5599C8378739047694B32373AE6AA960C71E14CD3D2CBE7B3630732A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "39b0d574-9ccf-49e2-a04d-998dbc46804a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "1615c42e-06d1-4bed-ac5f-8af12783f9ef", "value": "6144:hoM4GN9CrePDrDKRpBfseCNcSi0b/P/WX3CPyEZlLomCRtoK2H+7yqz0F7eqn:3N9FPDrDKRDEeCnpT/WX3y7O4F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075612, "uuid": "75cab393-9d87-44aa-9737-445ee47ba8fa", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075612, "uuid": "7cdbe523-a2b9-43f8-a7e3-33590d1f0409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "202e1838-d9b3-43dd-bf4c-7e0e68a8ee6b", "value": "SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6884ee2-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127816, "uuid": "2b19c71c-cc60-44f5-99e1-93c1d93b6583", "comment": "Malware payload", "value": "c92a958dec7da8ddc309b314f23e5096", "object_relation": "md5", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127816, "uuid": "d00e356c-ba4e-4414-b9d0-0b2b976d064e", "comment": "Malware payload", "value": "8f775f61078b5212543ac14e026f184e1286a913e4799dfcf30bb633aa1164a8", "object_relation": "sha256", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127816, "uuid": "70496de1-6bd0-44d6-821f-a32e9c4716f1", "comment": "Malware payload", "value": "d14a549d9d9ea31dc059b6222e72ffc52640ea52", "object_relation": "sha1", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127816, "uuid": "5acde79b-65c6-4fb2-8829-8b49c6e218b5", "comment": "Malware payload", "value": "0f68c9b9cf6d801f56ad3543dd6fbfc957ada26d5a589afcb6a78e1a84a89fe4b3daa69ee451755dc4f1dd38c7072773", "object_relation": "sha3-384", "Tag": [ { "name": "anydes.me", "colour": "#203F18", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127816, "uuid": "499a2c2b-459c-4e01-b784-fd632faffda0", "value": "T1A80633E546F817E854BE9362B8C83C5121571DF6E26FE9A81EC3FCF99E16819E13200D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127816, "uuid": "8b260f95-5f0e-441b-9b10-5031cb4c7d04", "value": "98304:hwT5/mkFT6ELBIOz8F2XHgBcr/lGWRIuDfeKUQK7d:hw1DHLBIbhcrfRIubrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127816, "uuid": "1770524d-c315-44ad-a445-216ac37fce26", "value": 3770572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127816, "uuid": "9281d39e-5c7f-4f7d-871c-e65317c7a608", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127816, "uuid": "45a56589-cfb0-4dfc-aca3-809d3b8c8216", "value": "hvn.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd2eaeb-4dc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694121520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121520, "uuid": "e61d12b8-8496-4338-8d21-9514a67fb079", "comment": "Malware payload (MarsStealer)", "value": "39c6cf660d9938f00ce6a44808ecd133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121520, "uuid": "03529a0e-f30f-4279-8641-9fb2920f0ed4", "comment": "Malware payload (MarsStealer)", "value": "8fceb104dd023177aa0e19f7d5049683a046baee7040bcea9d54da915994738e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121520, "uuid": "1f4de06f-574c-4237-9e53-e6d0d3ac0193", "comment": "Malware payload (MarsStealer)", "value": "460fa60cf7c3c5f0c5a9fd651e19f5e2eea241db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694121520, "uuid": "39f78673-3be4-45a3-8bf4-840b53bf5f46", "comment": "Malware payload (MarsStealer)", "value": "c65d2689aefb8bb2f9110039efa4a05ffa062cdb061be833432ae40a0522fd776c3f6b3217fde2abb62374e7eef2dfc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121520, "uuid": "ec80c7e8-501b-4b04-8df4-7802f72ce7d6", "value": "T12CF3E16A49B3BFACC8790E7D94DFFB3D09EE2E6426CE752D602B65A40C4834417D810B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121520, "uuid": "2e5aaf6b-5838-45bb-945a-b502e669e6fc", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121520, "uuid": "d0fbba4f-4590-49ab-a9e3-f5644ef21f98", "value": "3072:U3l4p06GLRIuqj7oQKq0h0fXlt25K5fRZ49Tu3/CdPEcK/WJSp8Bb8EG:VIts7oQKq0h0f1tikRmQ3/cPEcKy8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694121520, "uuid": "3374a5c7-9b1e-4230-86df-d8fcfee1dd31", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694121520, "uuid": "4e3f9269-e6b1-4e12-b97c-03783ce6cda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694121520, "uuid": "37e6281c-8bbe-42c6-8e7c-5e83ce489f1e", "value": "Builded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c903eb-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122122, "uuid": "2d6e984e-09a3-4d45-a8a5-c02c5175cfc4", "comment": "Malware payload (Mirai)", "value": "29184775912a910b5b82cb3f89b13b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122122, "uuid": "d1d774f5-d23e-4226-b339-a1c2b2b707fe", "comment": "Malware payload (Mirai)", "value": "902206877cdbe2eb58ff9f503f93f284743db92bf9f806f5c64c80b8ae4cb122", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122122, "uuid": "80624648-16f5-42ec-b41b-2fd3e55aec8d", "comment": "Malware payload (Mirai)", "value": "e75783cd35571f1adb45e36261e7513aabc2a0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122122, "uuid": "ce84a101-2f37-495a-804e-b7058d3be21f", "comment": "Malware payload (Mirai)", "value": "6d385a0c06a38eec9db87181ee2dbfaa44fc611bed175cc98b494ddf77896862fea9ea8d897f585f9a6625d91d4906ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122122, "uuid": "6010747a-1ff0-425b-bdb8-5d3503633d1e", "value": "T102D2E12CD95C7C05DBAE3EBD51DE56B5398C74C0931EB6CE17628408B627A8BEC070E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122122, "uuid": "9448849e-8b18-4a85-b780-308d0f44891c", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNi2XJb8WUM:CbDs06t4BEub4sU/MbUTXAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122122, "uuid": "ad54801e-fcec-4e20-a160-1ae4843de5b9", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122122, "uuid": "f64370b4-a5c7-4434-bdb8-3ed77dbe09c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122122, "uuid": "971e649e-3e28-49e8-8339-8f9cf94935da", "value": "29184775912a910b5b82cb3f89b13b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555986d6-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102715, "uuid": "154e3823-1779-4a65-b94f-de50ccd47768", "comment": "Malware payload (Mirai)", "value": "95308abe6263f5dfce7521d2583ec3c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102715, "uuid": "2ee93aee-8612-4d83-a512-2d6cc8db195e", "comment": "Malware payload (Mirai)", "value": "9022eb4b344ebda78a34d3b0d49344490d590b749ede89ef0b1d253cbeaf36af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102715, "uuid": "67a26641-fcb4-4471-b4c2-9a2120ec777f", "comment": "Malware payload (Mirai)", "value": "000bcffdcde7ec6920bcb087894df7255545444b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102715, "uuid": "61cacef9-6bde-4173-be7c-c430c932e2dd", "comment": "Malware payload (Mirai)", "value": "05f60b96aeb85e9f57e159d96c00dfb7fbca737d935522998a1190b8dfbaaa86f994dcc32cd8b5c651d80aac1de3ec59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102715, "uuid": "a60b051f-bbe7-4ca3-8b11-6bccbb659476", "value": "T143B2E161A1863E62DB70313AA97CCB00577B57F8B4E672712528B7AC4BD2C4B64B814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102715, "uuid": "5b2dee92-46d0-4f76-84a3-2830fdd35c0d", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdRhymdGUop5hKD:yX1De9kONQG5xD+jHMDzuRs3UozYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102715, "uuid": "8414b944-47f3-4e67-8afa-cbebf8d4846c", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102715, "uuid": "93e5868b-a587-499f-bd94-42c93aa073a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102715, "uuid": "0990450d-e427-44ac-9273-9b0d781b0d36", "value": "95308abe6263f5dfce7521d2583ec3c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e59cae0-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069176, "uuid": "38d7bf06-ca08-4e1a-9e0b-24c3e2e72dc3", "comment": "Malware payload (AgentTesla)", "value": "13bfb67f66d121061dcd4b8ef0e70d62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069176, "uuid": "ea6b48de-b510-4045-ad3b-061f6e64ef77", "comment": "Malware payload (AgentTesla)", "value": "9031046e4ced137007aef2a35a80ab5e4a66dfcc47505d7c7832283ec1ae2c5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069176, "uuid": "8f6e64a3-c688-4a53-992b-aa05b01d1ed0", "comment": "Malware payload (AgentTesla)", "value": "9400a61e9a30d8f7441d4e0ec1468e72810678e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069176, "uuid": "d753d171-47d0-4299-8328-f88c7a9d2c12", "comment": "Malware payload (AgentTesla)", "value": "6f30ae3554d23473a61a45ef4d34a92adebbcebe9df61607d0bf69e33d957fcbc0be25b50ba41fae640d0fdd9cb2c96e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069176, "uuid": "905cdcf4-55c8-4ab6-94ef-ea82208f2048", "value": "T12F257ED1F1908C9AE96B06F17C2BA43015E77E9D94A4C10C5A9ABB5736F3352209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069176, "uuid": "04761fd7-6aef-49b2-88cc-4e70c9fb3179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069176, "uuid": "b64f23d5-9e00-433b-b0ff-6542a4d4dd0f", "value": "24576:g381RkDV83xNYw5nEhlWWfB8UcIkQ/jHt+GMK:TwJ8zbEhlVfSUkm4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069176, "uuid": "e8cc153c-ce48-44e0-a0a1-e1bb4437a25d", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069176, "uuid": "44bbf3e9-70f6-45a3-8841-e532539702e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069176, "uuid": "072d5beb-3622-4770-9b2a-d6248ee5985c", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452f62fc-4dce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694125881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125881, "uuid": "0958948d-97ee-42ca-9f25-7e4c5b962360", "comment": "Malware payload", "value": "24e961892983870da418aff5c8230e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125881, "uuid": "594015c9-4c85-4743-a5db-01b94116d2bb", "comment": "Malware payload", "value": "9031a8646ed7e86fe86bfc4ebcf9d466de309a3d7d9f96c1085d7bfa66239d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125881, "uuid": "79fd5986-0efb-47c4-8614-df884805f600", "comment": "Malware payload", "value": "b548810e8d81b6e30c26e405a5094e40db6adb81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125881, "uuid": "84a8ae16-3388-4480-afd4-0bebc521793e", "comment": "Malware payload", "value": "5a5d1a7f88598970829035df4bcb6bd348df180608ea21d01cb009e73777314c4a245077b629e861ae08915c7c4ae8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125881, "uuid": "16563e33-2a9d-4fda-8c6e-a03b87fe1cce", "value": "T13C44BF82B0E083B5D57A3A329F1EE5357F7DD5394B505ECBA36C49397E382C08421AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125881, "uuid": "0981956e-246c-4871-9b02-38c14b6b882d", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125881, "uuid": "1489f08d-211b-47cf-968d-9b72607eff4d", "value": "6144:Dz6PWH9nd1kCh2EonGpRD3tESdM5kDvWbYZ:DeAHkChRD5d8YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694125881, "uuid": "acdb9a32-351d-4459-aae0-09240a9ca784", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694125881, "uuid": "553f2ef5-3e3a-4192-b0ea-3b068daf013b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125881, "uuid": "1744d83e-7894-4b11-8b35-f01a13a17f0c", "value": "SecuriteInfo.com.Trojan.Inject4.60850.24614.12619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ef9fd3-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067897, "uuid": "389c6cdb-a29c-40b8-936b-be9f8b2a71ab", "comment": "Malware payload (SnakeKeylogger)", "value": "3e7817369dd5d96f8ea1d9f373787336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067897, "uuid": "e0be08b0-c795-42bc-ae8e-1a1ecb38c93e", "comment": "Malware payload (SnakeKeylogger)", "value": "90a1d9ed818948ecf53b88389a0a5ae7f96b9c530a4df4ad831238b752935515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067897, "uuid": "ce2009b0-5ade-4c50-a24d-a6010ae5391b", "comment": "Malware payload (SnakeKeylogger)", "value": "b085be051b2bd39f160317a224bfe3ed832c9ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067897, "uuid": "d3b42cda-c012-495d-97e4-b601e0ce55cc", "comment": "Malware payload (SnakeKeylogger)", "value": "aec6347b7658bdbe3397e29cc3204469a698204408a183e4abfd03e8bbcc3ccbd98a37b4d42244ac9cb05d19c356fab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067897, "uuid": "a9ce69d3-6d15-46c5-b60d-134f1ed53596", "value": "T1A1C4021AB3FC1B6BC576A7F018601094077AA926A5F2DB494DC270E725B3BF10B42F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067897, "uuid": "5175b8c0-bb73-42d3-acb1-ac169a1417d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067897, "uuid": "7aab56ea-2f17-4ebb-b3f0-78245927fcb9", "value": "12288:r3c2iNHkDwMD83IYWclwe+3w/o+mV4ZgzoDID8LXe0sQQAu:r3c1RkDV83IYBlHA+mVcgzfDoXPdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067897, "uuid": "dc5e1a13-12ed-471b-98c4-126079c7ee3b", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067897, "uuid": "b1e92905-4015-4682-aa11-e1c035f18d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067897, "uuid": "b33c8965-d50e-44b8-951c-c0cd8734fed4", "value": "033MSOG232441305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b08866-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694067975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067975, "uuid": "3f7c4196-0dda-4c68-ab4d-6de625c08177", "comment": "Malware payload", "value": "99097e5ddee0166f9bfa4b59d9a753e5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067975, "uuid": "2ab86191-9bde-426e-9a1c-2202374424c9", "comment": "Malware payload", "value": "90c2750dfc0924021b5fa7d21cb7ba91a925cc29ae79106683a009154cdfd8ac", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067975, "uuid": "05827e3b-ef10-49f2-9a66-af501c0129e3", "comment": "Malware payload", "value": "a935ed4fd5cb5160d4cc3c2e1d4d318fe1d6446d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067975, "uuid": "b4c7b095-a6d4-4014-bed6-ead266e625c0", "comment": "Malware payload", "value": "f695e7ca5d1a692ecd4e9baecfc5b9de6f7d859f90f101a63c7f6c94eeb6a508879470e9fe06692b2ae6aa24f7770682", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067975, "uuid": "acb22f39-6d61-4583-9a4b-ae7e6a46abf2", "value": "T1F855AD213386C633C96E05B01A2ACB5B51B9FDA34B3194CBA3D86D2F9DB44C26635F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067975, "uuid": "35392aad-aad8-48ff-a240-ee9a72bd89c3", "value": "24576:Rw6x/N9YYVcW7LIJ1MXCOJ05YbswFbC2d7xLZrudqArzreq:RwK9YpqbCOJ05Yb59XzLZrudqArzre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067975, "uuid": "67eb541b-8e86-45d4-ad47-6d7d68f941dd", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067975, "uuid": "6f9921ea-e5af-416c-b712-8cf0d54b7914", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067975, "uuid": "5afce576-ab74-494f-adf7-4d1517ed5b4f", "value": "\u00a9ARQ_DOWNMB_FILESeqT4QOySCd68UKwbs85AO02mBsnuYbpcOum\u00aegrpkt.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e82791-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694079711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079711, "uuid": "53a24ac8-0c31-4950-bd99-6225b234e529", "comment": "Malware payload (Amadey)", "value": "de570434a20f15e623126a53fe8e2724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079711, "uuid": "63c2db70-d529-4d09-9589-1ef8fb48f50e", "comment": "Malware payload (Amadey)", "value": "90d900c24c5731bcfac25b160c5afef520d7d74d3f2183348e7c5696a4c6acc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079711, "uuid": "44ad1915-0afa-42ec-9575-caae948ca926", "comment": "Malware payload (Amadey)", "value": "7d8f168bfcc51eecd30df8115c4f8ac0dfe38fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079711, "uuid": "cbddab87-593d-4de0-b688-da275921042e", "comment": "Malware payload (Amadey)", "value": "39837d2157d3134522c4739954f49c4861088de8b2e73ecdd8000b6f234321313da67b95b1f99abf0375eb86c8bcddd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079711, "uuid": "fa1c61f9-d082-471a-b0f6-4106c6037529", "value": "T13224F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079711, "uuid": "141f41f1-25e2-4898-a91b-afe7f53b294d", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079711, "uuid": "2180df3c-95c4-4121-a894-719ed9e7a82f", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079711, "uuid": "fdada644-e5be-4a2c-8e4b-080a675d41ae", "value": 225999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079711, "uuid": "93e3c901-c2c4-47a8-8e84-8fa9fe8f803f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079711, "uuid": "935c84f1-b705-4938-9321-d0fa4449e5ac", "value": "de570434a20f15e623126a53fe8e2724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a3ed1a-4d25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694053402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053402, "uuid": "1d635ce5-bf6c-49df-ba4b-42986582c910", "comment": "Malware payload (Smoke Loader)", "value": "e38ec6e23fc6a300f1b3a9f0bae8841d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053402, "uuid": "4ef63248-2ad4-4c3d-ba72-88c8dca75425", "comment": "Malware payload (Smoke Loader)", "value": "90f21a4579087e8baed05ec4792c38a5fcd9fa5326011acc9a928695c962c117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053402, "uuid": "b491ecaf-06da-4908-9154-c88b415908b0", "comment": "Malware payload (Smoke Loader)", "value": "245f2faabadde4d6dd47d4e1a7dbe0248413f733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694053402, "uuid": "1447d89c-8aa1-4632-b07d-07066832faca", "comment": "Malware payload (Smoke Loader)", "value": "42383e91df1c8414777e8fef2597a0836dd9e3fd671a4924dbdc3618517231073724c019b01359112b4869e5e2aa0a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053402, "uuid": "63480ae3-157c-4546-a91d-bf191cd38886", "value": "T10F54AD22B6D1C076E26365344AB1C7A55A3BFCF29B2159DB7B943E3E5E302C08A74707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053402, "uuid": "944ec52a-1149-424a-adf3-af34ba726a71", "value": "d5b70e22276decc41f732fe8162e7fe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053402, "uuid": "e7627b61-eb28-466f-84ae-ca05d5cbf66f", "value": "6144:enoZ+wMSnJxi8TuqHXcme4COYiyJ/znpo:JtJx4q3cmsoyJbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694053402, "uuid": "8ffbb94e-0566-4315-b445-0c873817f165", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694053402, "uuid": "420bb1d6-b419-44c1-973c-e83935628ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694053402, "uuid": "da1c14b5-9a52-4959-8293-88795a3e9ab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244c83a0-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092325, "uuid": "5643c7e7-3396-4f59-b92f-f9a63bc8c34e", "comment": "Malware payload (AgentTesla)", "value": "ce4b854a49b0e2c50c68b9a74bc1ac8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092325, "uuid": "9194ac3a-5135-440e-856a-ef9b22d407a9", "comment": "Malware payload (AgentTesla)", "value": "90f4dbe5a1ecd502432550851c0f7997d84d3796dc632a77299231582ae05999", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092325, "uuid": "ddb3c483-d2a9-4c86-b638-4111dfd86164", "comment": "Malware payload (AgentTesla)", "value": "4057fb08d9e222eea2b36c9928861e0f60415c7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092325, "uuid": "a5b5d375-21eb-480b-a83a-f87cd98143f5", "comment": "Malware payload (AgentTesla)", "value": "04dc7a844b519b1d4b43974818ca4c33e39b0084cccf25e150766e6cd844c5b57a5d4de4b83f3a819d7ef138e5a86bdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092325, "uuid": "e4a44dc2-544a-4bbe-ad5e-077abe8cc2b3", "value": "T15E441F037E48EB11D6983D37C2DF6C2813F2A0C706738A0BAF49AE6526556476C7E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092325, "uuid": "ab8ad890-5555-4d9d-be03-959ea44ed651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092325, "uuid": "2f09091e-29f9-4037-aa08-74df944100ea", "value": "3072:ZQZl2/V11oAuDFBwRDP2+xERYTUyzT2Nd6nHzJe5/weC:Zp/V11o1BwpeXqYyzT2+w5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092325, "uuid": "2599e9d7-845b-4446-83e8-61e761684f55", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092325, "uuid": "daef8fe0-7d1f-4716-b7d8-861bead31025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092325, "uuid": "33d24e5c-cafd-413e-91db-24d0e9783cd8", "value": "90f4dbe5a1ecd502432550851c0f7997d84d3796dc632a77299231582ae05999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae48b3e-4d12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694045172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045172, "uuid": "88421874-175f-44da-9be0-94e4a2e0e53d", "comment": "Malware payload (RedLineStealer)", "value": "756d7ef12ed2a3a6e5de9e558cf89a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045172, "uuid": "efcd7f5b-d141-4302-a8a2-5873044d7582", "comment": "Malware payload (RedLineStealer)", "value": "917df51788e12073af3eaf072b658f4d12cd2187966a110e37521681dfbf6872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045172, "uuid": "89dd5488-84b1-46e8-84c1-ecb934641b76", "comment": "Malware payload (RedLineStealer)", "value": "56892f1d6e49e63930899d88231c642aaaf5261d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694045172, "uuid": "3bde7579-1301-44c4-af07-d337a7d634c8", "comment": "Malware payload (RedLineStealer)", "value": "addc3a160d97e64c820b8440f6aac8abe84630acfadd5a47fa80c7350dea9564406e0d2bb02338a1dc070cd005468f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045172, "uuid": "d40f2699-9dd6-48e5-90fb-662e798e5edf", "value": "T141C41203A7E84172E9B5177058FB82D71739BDA26978932B23418E9B0CB3584F57633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045172, "uuid": "05596e99-37a3-41fd-863a-cb68e92870da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045172, "uuid": "5d1be0fc-7fb5-4b71-a5a0-2efe17434ab1", "value": "12288:vMryy906pRqMAEeAiSl+7J+OY1Sl4HR+/Umx:RyjpRqLEe1Hd+OYmFUmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694045172, "uuid": "89038a55-b05e-4f69-aa7e-aceaef144b60", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694045172, "uuid": "5da91d3c-5599-49db-992d-02a0fa5e1aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694045172, "uuid": "85b7eb57-9e92-45c2-a855-e50ef132ce73", "value": "756d7ef12ed2a3a6e5de9e558cf89a34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83be5f86-4d89-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096351, "uuid": "41eea458-ffd6-4357-a4db-38a940b1230a", "comment": "Malware payload", "value": "505e10202de351908746101c0d116e7c", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096351, "uuid": "af66b848-dd76-4a9c-acde-6bd56bbf084d", "comment": "Malware payload", "value": "91b53e7912961b09319b8ab56def565de895bd6bf195b94f2c07d1654b842448", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096351, "uuid": "c933417f-ef62-4aeb-9b57-679d0e6f7df6", "comment": "Malware payload", "value": "55eb991181625236e3df1a6efd0c9b545bcea2df", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096351, "uuid": "881fd265-ce9e-419f-a525-fe46a22c6318", "comment": "Malware payload", "value": "21b950a25b3927b5691d89cadec6df7a93f72488a34ba499c52ea4bb0fdd46782e8c329b1dbc1fc2f975075e25e6554b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096351, "uuid": "2035f756-a733-4f13-a189-a5dc4b691a7d", "value": "T1C44176F1F723C0D04576A7779CA7D089AE78806A102109097ADCC99EF7F19606275E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096351, "uuid": "1753a3ac-88a7-47d6-9ffb-924b3eaab1de", "value": "24:VJYcgZRIx+KNr1Vje1N7GFuNKOfvIPyIHWb3zlb19EZOVxD1cWyPsc3/FFO+gfji:8c896r1Vje11Z9IYb19Z/cPFFpgfqpg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096351, "uuid": "f64f2526-6e0c-4a32-9935-3875c3de3fc3", "value": 1955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096351, "uuid": "ad240070-0e06-4acb-8d6c-35b32b2e5032", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096351, "uuid": "96cd3d25-6ef9-424c-b88a-f8c740aea18b", "value": "MQukhP3S.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2468ac5b-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052382, "uuid": "e83abb5b-be8f-4d84-a798-9a4fcfb9913b", "comment": "Malware payload (Amadey)", "value": "afc71fd777ed041ad2d83e7949d7d2a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052382, "uuid": "e201a82d-4073-47e3-94e1-d9fdaba1f34a", "comment": "Malware payload (Amadey)", "value": "9228dd1b37a0f6f3430c21f9d0454aab6338b8a23aec0591905cf3afffa69015", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052382, "uuid": "58c16344-5c23-4301-aa25-0a9b44576084", "comment": "Malware payload (Amadey)", "value": "96bddf9ba594c7d8a46fb5a4b3b15d76a4eb179e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052382, "uuid": "ed47894e-0c29-48d1-a1de-d6b1f6c0891e", "comment": "Malware payload (Amadey)", "value": "c5c23ff7eed087e9adaa04fadff3eed3c44f293817ee23caa12ef1dfd6c6eb6c6b4f32d290cfbdbf2a26e2fec63cf6b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052382, "uuid": "c7049724-40a9-460d-8762-c1b5959c6a52", "value": "T14624F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052382, "uuid": "c879e1af-a424-4e2d-ab31-671008882647", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052382, "uuid": "e4495f8f-edf8-49de-8d8d-cb098a1696aa", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052382, "uuid": "8e62f06b-f86e-4a60-b72c-97365010f686", "value": 225653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052382, "uuid": "39871ccf-2f12-44b0-a2a9-b47a0b881d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052382, "uuid": "602c5877-e2db-453c-ac9f-f32342c039ec", "value": "afc71fd777ed041ad2d83e7949d7d2a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73614125-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694086445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086445, "uuid": "a0d0d5f8-fe8c-4320-b6e3-12d7a7cd1ee1", "comment": "Malware payload", "value": "803ad0ccc897e7181feacf74e09b816f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086445, "uuid": "f9f1b708-9364-4e6a-927b-10826e197890", "comment": "Malware payload", "value": "92bbcd61b582e077289d103af51cf60b81d4bf9b7feceb731cbc129d41c67d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086445, "uuid": "49dfd949-45a2-44e6-85b9-26c5b4622b8a", "comment": "Malware payload", "value": "71bda7742d482badaa78cbe09f153e9c4614d05b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086445, "uuid": "8ba89311-2862-4921-a6bc-77d5c60ad704", "comment": "Malware payload", "value": "18b8573cd5451593518c3b3f578531ed676e77a65590dea1ea6f141848cbdeca7c84e42bbdbf2ce6bcd76bdfaaa4431d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086445, "uuid": "7c82ffd2-3cf7-416b-8bdd-faeaf92b0a11", "value": "T1E283D7D17DAA8CE6FA11533D89E7D3722A3DF6D046139B13A734BA355B13E8238C5206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086445, "uuid": "62c43eb7-14dc-4fa6-a781-1f0a4bf689f0", "value": "68fbab9bcbf8ca1ae61bab5b55b691be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086445, "uuid": "799a40f9-07fc-4aea-a02e-87ff01c374ff", "value": "768:WnsoN8rP4krzJGn+B4Mn+kKAv/HBfy3C2keCnHhtnys3ztMMBfph9Dff+s68ypTX:ikwkPJx41kD/KC2kJhtnyyZMURnn+D9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086445, "uuid": "ec83e1ac-156f-48c9-8ba0-63e88b4560b2", "value": 87111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086445, "uuid": "737b21a0-5e7a-49ad-b29a-62939d331024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086445, "uuid": "dc9c38ae-5809-4f43-8970-3dba0da1a891", "value": "keystock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a71296b-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "92217b1e-b330-4148-a010-ef7888ba7c9b", "comment": "Malware payload (ConnectWise)", "value": "58b3f338b484d6e9391b88be0417239d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "5f8570b1-f29b-46f8-ab35-fd2930f26a63", "comment": "Malware payload (ConnectWise)", "value": "9414819df5dbabe5073525a250edb76fcf382a2012fed2e5cd780c720021b69c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "41175b9a-6d51-4376-98e5-69d08a47ec32", "comment": "Malware payload (ConnectWise)", "value": "8b723d9b50737e6848fc778a41ee817b769c1c5c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075612, "uuid": "ee0e3bd3-7626-4d0b-a001-bc870d47610c", "comment": "Malware payload (ConnectWise)", "value": "03a8300b8c869525f8f25f535ccb6f6597ea65eeeecb1635fb68cd729e36ebb4089e2c0d16f44862b30e0857d399cb90", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "41ebeaf4-5477-4321-9e1a-35ed9eff4119", "value": "T1F5835B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "649f87d2-df82-4a20-9546-5b4bf12b0cd7", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "71b837d8-9844-4eb9-954b-4690b9fc6e61", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3uk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075612, "uuid": "13366cb7-7a94-48f5-a308-1e6bf4547d3e", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075612, "uuid": "6ef8fb4a-d385-4f2e-bb94-f644922ef0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075612, "uuid": "10b6bd36-1dae-4d02-b47c-4f59988a7e69", "value": "58b3f338b484d6e9391b88be0417239d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bac9054-4d4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694069708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069708, "uuid": "e05e6b29-b40b-46b4-9b71-ec8c5aa6cf95", "comment": "Malware payload", "value": "9865a020935741379a356d4d96e0574f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069708, "uuid": "d0c8cfff-d5a9-405c-8da5-5210413f506a", "comment": "Malware payload", "value": "946198134cdb5f7b3a49482c18e931986347e0435583585945e76e1709e8e4b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069708, "uuid": "dc410a27-f3dc-4bec-8166-d66474d07d40", "comment": "Malware payload", "value": "79c3675cacb4c9d634af576d380a5c28a681828c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069708, "uuid": "51338f02-49b0-4e31-80b1-d9fc12ed5d78", "comment": "Malware payload", "value": "6f0772fcf19498429dd2815a1fdfaf4a9c8a5e1d0b66bdb265a6f8be754f04cbb7263cff52be7b10a9474694f848c919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069708, "uuid": "fe41a0ba-919e-4df2-a2d9-5c45b12f5eaf", "value": "T1EC16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069708, "uuid": "3945d832-3a6f-4f17-ade2-2c256c5eae0a", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069708, "uuid": "51cdc2e9-11ac-4841-b973-6b10ba320176", "value": "49152:3gh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWvjXNO:7a71fTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069708, "uuid": "3ea8ef5f-1560-4cb5-8c09-bc01653832f2", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069708, "uuid": "59e46942-bc96-4486-a4a3-8703427fc85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069708, "uuid": "9afc7d51-84a2-4c74-9e48-917ec7491c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417a9889-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075624, "uuid": "0965fcb0-0cb8-40c0-a407-0393887d8092", "comment": "Malware payload (ConnectWise)", "value": "78c35476d17e8fa70c976dbe746e4300", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075624, "uuid": "b09f3ebe-f14c-43b5-b414-ef0f0a506bcf", "comment": "Malware payload (ConnectWise)", "value": "94c33c58dd56e9711b9d9a28f1662846436237abc4eebe676d820c182abfa3d1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075624, "uuid": "d0014931-0d33-4376-ac4e-63a321bda2a4", "comment": "Malware payload (ConnectWise)", "value": "64b751b0da4b4dd388005864cf2b311cfe524103", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075624, "uuid": "63b7abd2-3de2-486f-b71f-0a788a8a669e", "comment": "Malware payload (ConnectWise)", "value": "374b2b28143526190a548d03c77968978fabb060278bd4e14a1f0fb7dc2dd5d7678a7db04870ed194cdaba8132fe47bd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075624, "uuid": "4c2818de-0946-415f-b876-5ba0e2deba09", "value": "T1E8836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075624, "uuid": "c935f944-c25b-4d03-80f0-c71286992a58", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075624, "uuid": "2a42fb08-4dfa-456d-b4eb-027e7ed91b3b", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3bKk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075624, "uuid": "73eacd5c-4e53-45e9-bde0-d87f495c8f65", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075624, "uuid": "36d61583-6099-4420-805e-807b76c8ccf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075624, "uuid": "4d173c3d-7bbc-429b-a7d6-b4ed5a00b481", "value": "78c35476d17e8fa70c976dbe746e4300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45d5e50-4d8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694098204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098204, "uuid": "e09f1705-10ef-4ad4-a351-88b6d1a24c6e", "comment": "Malware payload (Mirai)", "value": "2a388f95d50f8a77c1e8220047bfdea0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098204, "uuid": "08452b78-97b9-469d-9501-d54c4227f199", "comment": "Malware payload (Mirai)", "value": "94ce2f39043c9d7d163545a94fd4ddaf061e5075c04206c763e9aad453c26ee1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098204, "uuid": "f8c62d37-fe25-4859-8140-2f1c08ae6dea", "comment": "Malware payload (Mirai)", "value": "2b2db13b5be892d39bfdb777c49be65d3721b089", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694098204, "uuid": "e3a4238b-75d7-4141-9034-5505db1642b1", "comment": "Malware payload (Mirai)", "value": "b51342e9d86cbc11ac0da92ff752b3f428a4c7e412f944c86d8f1d0154f339fa3d3ac4561f689b183815deeb4ab028a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098204, "uuid": "94c49ec4-5832-4e57-8ab4-210bb3d00e5d", "value": "T1EDA2E115BE1846CBC8366A3855E9FAE21257FC71F2ECCC092640D15FF5A33A92474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098204, "uuid": "216b568e-1fb5-4c19-86d2-d8e50666ded1", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKA:798o08kxofBE+ZkXaqGbp2F2TWul0c59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694098204, "uuid": "e1f75340-6705-4f55-9612-f248e0fdfd0c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694098204, "uuid": "95d6c5e1-c869-4709-8671-849e2805b27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694098204, "uuid": "49316bf3-a47b-4643-aee6-fb522074b4af", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293138c7-4d57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694074724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074724, "uuid": "eb5e127f-7917-4ff9-ad69-64fb1295cbd1", "comment": "Malware payload (Smoke Loader)", "value": "3f6d5376b6d40c82644287c7621dfc5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074724, "uuid": "c36bd655-f70e-426f-a917-e11d15e87dbd", "comment": "Malware payload (Smoke Loader)", "value": "94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074724, "uuid": "20d332fe-ee3d-4a93-b523-281bc10f1669", "comment": "Malware payload (Smoke Loader)", "value": "f54b9ed42b60eb6793cd55ed25e6f2bd6120218f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694074724, "uuid": "91a43b19-6951-469f-9f13-4b879df56b68", "comment": "Malware payload (Smoke Loader)", "value": "e1de0b0b91138b409abe35ae76f60d114f7de4f2dbad376d6c9462f907149068de60b7f2140f0a674584a152fe9524df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074724, "uuid": "3a4e9a98-ffc2-457d-b004-9e1f69ce48f0", "value": "T136D44A17BB66C9F1E2C96736C69B100C13B1D986E39FDB0A798E23A558433A6DC015CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074724, "uuid": "0394ebd7-70cb-473e-a546-c6cd47c81b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074724, "uuid": "87606b9e-6d71-463a-8281-03ea9a6cceb1", "value": "12288:vbNq3U22k24PnuBvJTvfIVcmaBhIaQBanLFHL4UhnPtJHKFm5fto1XGTI:zI24PuvJTEYHLzhnPwU1cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694074724, "uuid": "04e96de0-d017-4050-a5ae-09a84a6fd10d", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694074724, "uuid": "16e9b2dd-5a98-4293-af24-59c0f12f75ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694074724, "uuid": "c2c767d9-bcc3-4055-9641-94af3a47e59c", "value": "6Js1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896b6597-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694090777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090777, "uuid": "228a6a36-93bf-4aea-8a39-9fcd12c73624", "comment": "Malware payload", "value": "4ad740eab5390a15b4c28acc6547da03", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090777, "uuid": "a1e85366-2c54-4e03-b563-af06b9c981d5", "comment": "Malware payload", "value": "95822fe1ec062ae014e4811be7e84ee4ec400247183531da791e5eab9f2f7d08", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090777, "uuid": "1bf1a71e-ab8f-4fdd-963a-3584f6ac7570", "comment": "Malware payload", "value": "d8060d5c067daffbaf118b03084a1ba5695c8737", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090777, "uuid": "c93ba640-43b0-46f6-98d1-6cab9266e10c", "comment": "Malware payload", "value": "4f76f8f0f8fc67316a6bf4e8edc7308b11af58b28fcd86dfcb9f92e459b948c98dc9cfad3fa6942c0c8d217dcd65c582", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090777, "uuid": "1ad26139-ea17-4460-9492-16e7da88a668", "value": "T1AB24F30267ED1608F1F32BAD4ABD15654B2BBB61693BD16C017C160E4BF3E408DA5BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090777, "uuid": "26e91601-2959-4565-8e49-67e5e706c4e2", "value": "3072:w4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhi126OxiqNB+mBX4zhHoMVGhlhiA:jTTjHr0lmmnlTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090777, "uuid": "0de6d566-b390-4239-a240-8a18c75e0764", "value": 230156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090777, "uuid": "d58bf66b-bca1-4149-82ca-90f221de1b57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090777, "uuid": "5e215d1b-c04a-46c6-9488-317aada70a6c", "value": "hhhhhhhhhhhhhhhh.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f69c4fe-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094250, "uuid": "520ce454-3083-469f-af1a-d5610cdfb28c", "comment": "Malware payload (AgentTesla)", "value": "a773dfd35ba03d42a305754fe4443f9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094250, "uuid": "31e8ace7-1c91-422e-a78d-584970c4e8eb", "comment": "Malware payload (AgentTesla)", "value": "95dd113d2239a754fd3e2a8314429df25ae396aeeed43029292df04e830338f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094250, "uuid": "ec780db3-a454-4678-b959-cfd042f8566f", "comment": "Malware payload (AgentTesla)", "value": "2f5169d61417fa0f7035e8a1aadda9c49c730055", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094250, "uuid": "1081e45b-2917-4d31-904b-30d43372ab40", "comment": "Malware payload (AgentTesla)", "value": "76dbe6d9b42d4767f521c33e02a148297005a40bd3d79cef7f941af7246b082a7386b9b6285061d56cf17f1e374b2059", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094250, "uuid": "7e3f1c5c-82a4-4604-b2e0-a4f320516d4c", "value": "T1D4340D537E48EB55DA583D3B82DF6D2413F2A0C70673960BAF48EE6169412837D6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094250, "uuid": "d911d456-fd54-4007-a7f0-a410f8658cca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094250, "uuid": "155591db-29ed-4812-a4f6-498d98af229d", "value": "1536:Yf0Psog8gvmrTNZSlXnJlgYTTEULMqmHi3SofNR5Q3vIEvF91QRwxG+yKLa3lIZn:YD7Rz5l5fm1oRQgE6RXXKilIk8R4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094250, "uuid": "5bd1dfde-fec9-4715-a645-624ad9033eb0", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094250, "uuid": "ff1a1f79-2a85-4575-8356-93ada4501026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094250, "uuid": "6a3501e7-587d-42f9-be8d-b3bca365f63d", "value": "95dd113d2239a754fd3e2a8314429df25ae396aeeed43029292df04e830338f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef748030-4d40-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694065178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065178, "uuid": "1b513b90-bc4b-4ae8-a5eb-d8b6de04fdcc", "comment": "Malware payload (AgentTesla)", "value": "f14c4625afb66e9f18e5e155dd0f1da1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065178, "uuid": "acd1bcb8-e8da-4626-99ab-c8f1214fa2f9", "comment": "Malware payload (AgentTesla)", "value": "96277db97cbb552fc6a804bd4eb65e71cb6271fd3c3f6a9aca1aaa4c8ec777cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065178, "uuid": "db4125c6-5b6a-495f-9633-5bf15c56fa99", "comment": "Malware payload (AgentTesla)", "value": "57635d32a193babf701ecddb3e21253d049607f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694065178, "uuid": "f860a926-f9fe-4a75-b198-8cf5ee93ae89", "comment": "Malware payload (AgentTesla)", "value": "cfdf8874074ae24b1a8c14392343607643fbe42814d593de949221a067178141e0cf9eeb4ad1f91808d00e7ba0973048", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065178, "uuid": "c6f8aded-36dc-4cb8-b594-6790105cfeda", "value": "T19E43146D874F01A9CF62927B971A5E0542FCB73EB34152B134AC43B533EE82D91262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065178, "uuid": "c9bf77c9-ed04-4af3-8afd-7523243afca3", "value": "768:rwAbZSibMX9gRWjnLxq43xDdczgBEsZyIIjI74iQ5rFRl:rwAlRC04BDWzg+sZy5jI74iQ5x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694065178, "uuid": "0cab5bc6-63e5-4545-a5f5-e3da0009b3f5", "value": 60464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694065178, "uuid": "bce96b1d-5881-44a3-83aa-5900a7d07bfc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694065178, "uuid": "4791b536-a1a7-49bf-ba73-f6445e2838b1", "value": "f14c4625afb66e9f18e5e155dd0f1da1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3f2f8c-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075511, "uuid": "c4b18cd6-bac1-47e1-b94a-f4f1c70e3734", "comment": "Malware payload (ConnectWise)", "value": "3d289e95c31e1537ce415dd624157839", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075511, "uuid": "7fd1ebf1-a62c-43b6-8e51-c66c9e46b225", "comment": "Malware payload (ConnectWise)", "value": "9646eba14aff835e90afbe5ba3e563a38ca8ea1acadcac47d41041f1cb9db583", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075511, "uuid": "8d06b627-aad9-4526-9c48-b1e6f6170dd0", "comment": "Malware payload (ConnectWise)", "value": "c8922604f8ae762f4ac98a8d74dc9da933f362e9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075511, "uuid": "0ba4c515-aabb-4c9d-8a82-d92a733df2cc", "comment": "Malware payload (ConnectWise)", "value": "8fac4504eb80b7ac2a555555d41469aaf81d112eaa3875e111a179a28d76d7383ffb088ec6ba2ff3a9bdff2b6018785b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075511, "uuid": "1a0e84e1-2c0f-4020-accc-d6c213a6b8b4", "value": "T127835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075511, "uuid": "379c6783-3793-4680-a65a-686a31e09551", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075511, "uuid": "d5511027-a9bc-407a-b89f-be5c649e292f", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx30k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx30k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075511, "uuid": "943b2b1a-be6d-4bb0-96e6-60cb3d142118", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075511, "uuid": "514d6f74-28b3-4645-a90a-8a6b04f6fead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075511, "uuid": "463a711e-4020-4d97-a3a2-9d59d012da08", "value": "3d289e95c31e1537ce415dd624157839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b793f6-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067893, "uuid": "d386cbc8-c16a-4182-9d4a-8f0a6f4acedb", "comment": "Malware payload (SnakeKeylogger)", "value": "9a83e7c0b7874f6c31f718aed6114763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067893, "uuid": "32278a87-af44-4141-b292-c3d85f686a07", "comment": "Malware payload (SnakeKeylogger)", "value": "967883efde0f9df6caa8f1cda685f7839344b755148e6c41d7c515132268bfa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067893, "uuid": "6573655c-a98e-4695-808d-ed70e711dbd4", "comment": "Malware payload (SnakeKeylogger)", "value": "eab53066922d294fb3d0f41d98d595a54b4e0efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067893, "uuid": "fc674e3b-bd3f-4c68-a289-ac97e07ba9eb", "comment": "Malware payload (SnakeKeylogger)", "value": "7b45c797e12651ac505cc5d3428b24d72d1a53b0fd7845817c2ac23232c4e9a1516ed7529c5c538703ee543c743c46c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067893, "uuid": "12abe15d-c164-4c7f-8ac5-d7c62a601f66", "value": "T19DD45B0123F59B11E57AABF1DA74812287B92956652EF30D9CC168CA1EB1F139FC3B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067893, "uuid": "5da7cf09-8aa1-493c-9df5-d73a53e9cadd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067893, "uuid": "8d659bc4-2581-4e28-9273-8b0cb88b75c5", "value": "12288:LODphClGCx5AisWALcX4d6hKCXt35dxC:LTAIXQ0Xl5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067893, "uuid": "d3246b2c-f02b-40c4-8365-f14b21b4a686", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067893, "uuid": "2dafab55-38ce-49e8-a923-7d26e9c29183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067893, "uuid": "feddc33b-479c-411f-8f3a-f2fffb6e221a", "value": "ORDER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7d7529-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081499, "uuid": "8e1b54aa-b948-4271-b6cd-638fba5c6034", "comment": "Malware payload", "value": "d86bef057de846589ae98afbc9044569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081499, "uuid": "c725f910-1687-41a8-a69f-01dc6bec38e0", "comment": "Malware payload", "value": "973e8ee15e00b702b03fa42e45cce60344dbe7dbc7d3213a81a53623c303ff5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081499, "uuid": "bfdc5c6c-f924-4b75-b0fe-fad6e6d52ab4", "comment": "Malware payload", "value": "e1e4b06ca02a30057f3ce8790ebca032bedbd4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081499, "uuid": "886b3079-06a4-4a8b-981a-82b53b3de00c", "comment": "Malware payload", "value": "37deb929ab2dc1ef894cf7c79d7d4c53eab58ced4c8a16b2e1bb59a60f6b67aea1f216cc113fab96dc3209b48e434bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081499, "uuid": "e7599346-9a8b-4a8f-ba05-12775271c05f", "value": "T17F144942BDC09871E87E09395468D7B44B2FF9209FB1ADE7334815BA4E306C29E35E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081499, "uuid": "be0df751-5643-4361-a49e-a2bd1124b608", "value": "dda765b9352ee55eed4377f5697f2360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081499, "uuid": "b4a72492-dd84-47fa-b823-5bbe6d01d42a", "value": "6144:oc8kexLZOLtbbGHt4Oal76+clIgXFpbUvCd:oc8cGN4O876OgXHbUvCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081499, "uuid": "5d64bc8b-c56e-4c65-9f72-824fb65efe38", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081499, "uuid": "356510de-ecc8-489b-9ede-e28e808dcc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081499, "uuid": "8583e3d1-3ca8-46ac-871b-9eb079218458", "value": "InstallService32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2ab3c2-4d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694068667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068667, "uuid": "b25ae9b4-3eac-4aa8-9d5c-024d80e772e0", "comment": "Malware payload (Stealc)", "value": "55f5cf5b3fa2c1cfed7289e6040d01ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068667, "uuid": "59824c4d-8d86-4256-8de9-85d4a089f1b6", "comment": "Malware payload (Stealc)", "value": "97768c478c5e2eceaf19c74c3e75b871d8c7028f3a83f6ff5ce74fd1aa6860c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068667, "uuid": "67ba6ad1-9e6d-47b7-995d-409b723c4eff", "comment": "Malware payload (Stealc)", "value": "4eec77e4c1acb9f6559fd3769f2f93b60d132979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068667, "uuid": "41f1e17b-8839-4e98-b065-cbdfe0b7e44b", "comment": "Malware payload (Stealc)", "value": "7e6f64bdf19b51935199698d04d1d3fd00e27a31726ef34629e1ba149ada7a464f07b8d407838b4cd236faa562db14a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068667, "uuid": "5410e74e-b6ad-4f40-aec2-eba6dc40dcd6", "value": "T11144BE2276D1C072E12316348AF1C3B19B7BBCB18B6555CF6B942B3E1E743D18A7634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068667, "uuid": "436f5d14-59d5-42e9-a86b-6b572487412b", "value": "b47cf3c5038ad34425cf7f361b3395f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068667, "uuid": "57c78d8c-6a37-42e8-8b06-1694863eb290", "value": "6144:2FP01Wcfw/sFg7wOtvm5sy4Gq8fgiucvv:21rcI0S7wO5mOl8Igv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068667, "uuid": "5df8838f-5496-4ffe-a9b3-98a4f525f09d", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068667, "uuid": "698fc930-b824-4dfa-8f9f-b778a2382458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068667, "uuid": "2e5ff2a6-76f1-4a2f-923e-78d770ae9469", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1323ed-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694090380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090380, "uuid": "1740bfc5-e350-48a5-ab4b-8f97d3d6002e", "comment": "Malware payload (AsyncRAT)", "value": "0347caf3f2cc9a359aaf00b773ad1a7a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090380, "uuid": "3e294e2b-d4db-4281-a932-f8fb98b6e56c", "comment": "Malware payload (AsyncRAT)", "value": "98233686743b24d8dc1565e11dea472b2592b41d94bfb0b2eb6176c01a35e78e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090380, "uuid": "be2af75c-0762-4682-a5d9-d9aa1637bec8", "comment": "Malware payload (AsyncRAT)", "value": "03244d5bf4bd7648b86b81e0424e22217517b70e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090380, "uuid": "51ba6be8-0efe-42b2-8e8f-e4324ae1ae6f", "comment": "Malware payload (AsyncRAT)", "value": "6ee2b445ff43b45fc07a098a33c9b922c2df6bcbec7842daa66f2e6419f56ee1e98d694ecac01a24d987bce3df625710", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090380, "uuid": "355274f5-9c29-4917-b54e-ecb2e1e2ec92", "value": "T1BC448FB303C407BAF5840FC480AD621B15F1C16E746829AD9BF2199B7C7AD97AC74B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090380, "uuid": "97872fb7-9f0f-4d2d-b629-d674f0ab6a55", "value": "1536:ez5LkCsix3OOHLGdkP3YE4ZeLXxMxgswiYD:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090380, "uuid": "37869ab1-21f3-4bec-8a72-ecba3948fa51", "value": 269973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090380, "uuid": "5f8d6a76-0bf2-4ceb-9758-75868b50c8b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090380, "uuid": "6a0a2ded-05f5-48e1-8df4-b00d9ca7f159", "value": "4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87908999-4d3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694062427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062427, "uuid": "8af635bb-dc1e-4baf-9799-792d661a75b9", "comment": "Malware payload (AgentTesla)", "value": "919e0476c8db6a5ca2fab11334f1e55a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062427, "uuid": "52aad278-b78b-45bd-bd69-d25fc148c367", "comment": "Malware payload (AgentTesla)", "value": "983aa00ee743b167b2ff1e8159844f36d971179fe86ca794405f32d865d0fea7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062427, "uuid": "64da75e5-1ae0-49d8-a969-1b4b4357963e", "comment": "Malware payload (AgentTesla)", "value": "c1fb2dcfe7f0f152c6c6a4f506bc16736aca6fc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062427, "uuid": "5ed92e9c-e672-4e61-9949-3af6bec45734", "comment": "Malware payload (AgentTesla)", "value": "dc2f87e2643d639dc562c399dd1da5117fb9c546abce565caf95f2a5bbef3f11d7454c133151a90c160c209b8ee44bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062427, "uuid": "82069c95-95b3-4d18-af58-48074519bc76", "value": "T1A13563FC5CFC1136D9A0EE908ED9851BB1C0A57FF2896C1D97E20B650252A4AF88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062427, "uuid": "ce7b8ad1-2294-433e-8e74-a5d6e2c0fcfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062427, "uuid": "18827f2e-9720-4399-b676-d28412556810", "value": "12288:aZ6A6XH95oR3yhngzCSAccLogU3Hlds2Lta8:aQ5U59kUXlOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694062427, "uuid": "8f830de1-6a9a-4f09-9abf-9e0b5b3c53e9", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694062427, "uuid": "83ef12ec-1950-4fd3-a837-ca345b62ba1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062427, "uuid": "588986ad-7834-4ab6-ac10-6118d9ce66eb", "value": "919e0476c8db6a5ca2fab11334f1e55a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bafc609-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694069171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069171, "uuid": "320c07f2-1274-4b5e-ac61-ac9f8a48f73b", "comment": "Malware payload (RedLineStealer)", "value": "296601d01c0ef58f64914ffbaf7e0d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069171, "uuid": "74b621d0-d9c9-47d8-8c63-dc5bc54f54e3", "comment": "Malware payload (RedLineStealer)", "value": "984715b29dba4f202b0c63b5c81ef3ef74ce00ff2da2d15e4d49cd116fb47648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069171, "uuid": "f0e447c9-73c2-4d4f-af4e-956a3545582d", "comment": "Malware payload (RedLineStealer)", "value": "17819e918fbaa53a5c9810f9581fddeda82f35b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069171, "uuid": "5eb0dadd-4f46-4670-a566-3f0a2755780d", "comment": "Malware payload (RedLineStealer)", "value": "2cadbba343a10fad078ab8f3bd1360c07a8a1e8f38f80991620714a2d7e9b013e6fc5f9e38df6b5ef9a47b545857b8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069171, "uuid": "f8a2c32b-9dc1-452d-9776-a09e805c0c96", "value": "T1EE74B330A0F19AE5F8A68EB28EA1E619FFE71C508A51425FE17439F616337C0D2151FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069171, "uuid": "75596976-b6e9-450f-bc1a-a680c58b0a72", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069171, "uuid": "d56ae066-823d-4322-a8f6-d2f530ba45ef", "value": "3072:lDKW1LgppLRHMY0TBfJvjcTp5XM71hEbaFSkjiRrPenUjTYm9kPGJPy5:lDKW1Lgbdl0TBBvjc/la+6noYmgGJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069171, "uuid": "bf221070-939c-4464-a575-93929344159c", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069171, "uuid": "82ab072b-4cb5-4852-a00c-08d2d9069e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069171, "uuid": "700813d2-7560-484d-ad3a-1c31110b75aa", "value": "E-DEKONT1,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa44b20c-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694079799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079799, "uuid": "b305605b-b0d5-4704-b984-8441bea3c659", "comment": "Malware payload (SnakeKeylogger)", "value": "613585e8e9f9ff5a3201a9018bd74517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079799, "uuid": "22bc5fb8-7a22-4f4a-b8bc-c3e1579bd4bf", "comment": "Malware payload (SnakeKeylogger)", "value": "993987746a70fa34efd8d7c5bdde02fea3d273bf10766ef49b7447a594b3b0c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079799, "uuid": "1cd27314-4d0a-4969-b9bd-3adf53ce0718", "comment": "Malware payload (SnakeKeylogger)", "value": "edd4508120feb7bb6ce67fb009f1fc1c35072766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079799, "uuid": "b0dbc420-bfca-4510-ad59-63cd4ef24baf", "comment": "Malware payload (SnakeKeylogger)", "value": "762943c95d4f7c4010fde81ce79faa27fdccc3ca03b758e5570675156bd84c0edcc4a0e08d608eed6063617a571474d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079799, "uuid": "ec98e04a-b991-49d5-9c58-a162faa315bc", "value": "T16DC4EFF81862C7E6D3B4A3FF54AB95309E67BC40247186DD377C3A840DA6AD70922D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079799, "uuid": "11ecce59-7b50-4492-9e84-0d1f5ccd3cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079799, "uuid": "780676e9-9e19-4161-a746-3fe52e0400cc", "value": "12288:A5fVsbR2po1BZ27kIFvH6qnpcR5iO/X9uH71zjH:AtO2pgokm62pw5iOP9C1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079799, "uuid": "82607dde-364f-46bd-a90e-a3f2f3385693", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079799, "uuid": "df794664-f33b-444d-979a-73a65ac72737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079799, "uuid": "3f1e4581-c14f-4a8c-9e57-646ea994df1f", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7991886-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075500, "uuid": "4fd1a1c1-10b8-47af-9c25-97650cc2e751", "comment": "Malware payload (ConnectWise)", "value": "2d6a0b17806b0cf180529be06cce4cd8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075500, "uuid": "29fcbbd8-1593-4872-8b0a-2c432b0ff28e", "comment": "Malware payload (ConnectWise)", "value": "9a3d9f0c22e6e1dbc3abfac96beda2a7f22ab259d1f04c5f4f4990175e4ab6e1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075500, "uuid": "2fc1ccf5-a510-4c55-9e82-41f9d36b9bc1", "comment": "Malware payload (ConnectWise)", "value": "152bb622ce52f9b48b3b46c45caac7cd5aee8e8e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075500, "uuid": "c3f525bd-8c0e-4f7b-98ca-32c12d284dea", "comment": "Malware payload (ConnectWise)", "value": "22354e09430d67fb75351a7c1aa86470abe180b0d4f8111c71f6105c1b946381edd7d52ce2469a28f6521f79c9a77eba", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075500, "uuid": "a133f7d5-b716-4512-94ae-a3ed586604cc", "value": "T1E3836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075500, "uuid": "27ca9a24-d706-44e4-8f58-d7b7c43ac04e", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075500, "uuid": "431eac66-2771-4fa9-ac3f-b35cef72e99a", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3ak:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075500, "uuid": "51d36d6b-80d6-4844-9ae2-9ceced8132ce", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075500, "uuid": "20b94ad1-c551-4ac8-aca3-716b4b8e657a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075500, "uuid": "e622acb0-0a27-4e2d-9f07-48acbc5d2326", "value": "2d6a0b17806b0cf180529be06cce4cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e79c00-4d87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095275, "uuid": "0eca6e6c-2815-4be7-8066-d921e0332197", "comment": "Malware payload", "value": "5607a96ef110de5c23d2a12c510e6eaf", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordVoiceLogger", "colour": "#E44182", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095275, "uuid": "79aae874-1f2c-48ad-9957-08b5b27ce85f", "comment": "Malware payload", "value": "9b311fcb6bff069b6658b0784ea8fdad699a02f8b68aad4aba290099e6c28925", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordVoiceLogger", "colour": "#E44182", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095275, "uuid": "8ef6f87d-3bb6-49b8-b1d3-288b1e614cc2", "comment": "Malware payload", "value": "4ad6bb235f0aa316fdb4b34d8754f442c82febac", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordVoiceLogger", "colour": "#E44182", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095275, "uuid": "707754b7-0576-467e-be95-b557e15cbc96", "comment": "Malware payload", "value": "eac284b80ed128ff74bc88209754c71b31a2ff377dc3bc0a2ce15065c6e737e4e7a3faf252cdc53b0448bb80b946b4f4", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordVoiceLogger", "colour": "#E44182", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095275, "uuid": "f504e862-faf2-4846-8d30-5104fa1dc374", "value": "T19D2162B8390BC0124A3BE37AC8232085D93458B751989F407FCC45D40FF606879AEE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095275, "uuid": "172cfcb2-8bac-45ad-aec2-116f00b8ee84", "value": "24:s7hc0KlzG5Qj71E5XVst7KSt7Y/1zsvCOW5xWGJKWTw8vLPvulJaQ/R5WgDyW0I+:YlKZFStV2ZM94a3w8avlrtTml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095275, "uuid": "ca4e9305-47a3-4a68-ad3b-a3ae9b8ca194", "value": 1371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095275, "uuid": "5bc6637f-c794-4de1-bb8d-7c86a288bae8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095275, "uuid": "4ca11a39-55e8-47df-b93d-ad7f8fee6998", "value": "5X7mcLBT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80be2ebd-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694089903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089903, "uuid": "433a5bb0-e872-484e-8b48-77901a6060c2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f9341b039230c180f75813bbf1d2052d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089903, "uuid": "4a865ae1-ccac-465a-b19f-1d5d77b792bd", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9b914a04a6b4acb86915551f54a471fd3fc5edda4f8b948416db38808fa291bf", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089903, "uuid": "81e5114f-a51d-48af-aaa9-df030e29b63d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3cf9b1b7ac82652928c460ab5b82d0f56295db01", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089903, "uuid": "eab8da37-f284-44ce-b11b-a0be7a37cefc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ef8a462e9f74d55c5882903f6902cbb9722be7c17bf225937fdc98422f71a147d312b557bd56fa8f2410338ca0694985", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089903, "uuid": "04d9e4bd-0dfd-4003-9702-cedf0795ad43", "value": "T1E86533115311C634E690FEBC9C94CC4D8B3ABF331D3892C8E66D2A4B2B1B6615C5EBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089903, "uuid": "b31ec740-6ce6-47b0-a384-a4c9da74c008", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089903, "uuid": "3a365d1d-ce3a-4786-a7f9-486e91633922", "value": "24576:YI39dvQspKcxskP5Vn3sfjSSLZBUCiBmHZZyOfpGE2+VNrXhgebVKoyInpD:Y6dYspKc/3Ob5igvyOGZqrRVbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089903, "uuid": "a2914879-9059-48b1-8678-345d24baf9c3", "value": 1495089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089903, "uuid": "09ba5fc0-e2ba-469e-a112-be8a0402aedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089903, "uuid": "08d2af38-21e8-49ad-b157-f3a231b5c612", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00257b9-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694086627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086627, "uuid": "646409c7-88b9-4f49-853a-b4ceaa4ea8c1", "comment": "Malware payload", "value": "0676bcbc8a1c9a4b7d3a351dde4fc777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086627, "uuid": "3495ed2d-d66a-40f1-8581-0c6c405e0eb3", "comment": "Malware payload", "value": "9bd7d77fd5ef1c8915501494fb6ffc7ffe3cd664958a74ef04622b7c4ee5a67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086627, "uuid": "c4eed2c6-c0da-4e56-bb73-b65a5333899c", "comment": "Malware payload", "value": "9f698c1ce1885f306d292fd955e1c27b3b205ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086627, "uuid": "13df64da-8017-4654-acf6-0fd59981ba11", "comment": "Malware payload", "value": "7830bdc8da135d3efa349e5a4b5a89dd02e767f567593528ba6ed8ddfe8d55497ccad0ad632364b681ce985b68ca7738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086627, "uuid": "8b5cd642-9c9a-49ea-a57a-b40e28b2bc7d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086627, "uuid": "d9bbc6c6-a1ba-4e1e-8dfd-1d9bcf88248b", "value": "3:OkvV/Dll8t7lslK1111111111111111111111111111111111111111111111111:bVll8JCK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086627, "uuid": "754ef560-bcac-4766-9ea9-b2b0ff09cc13", "value": 4999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086627, "uuid": "8fba7865-9cf1-4bad-80d1-0fe2a566f33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086627, "uuid": "4e866b8d-55c7-4392-8d2b-e3f92e92dd22", "value": "murphy.1277.a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53133b8-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096058, "uuid": "05baf85b-b2c1-442a-8c2d-2dcd993143bd", "comment": "Malware payload", "value": "399189eae9b6422fbd75cd79c65265ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096058, "uuid": "6d3ed999-eae2-4d7b-be1f-8e952541eb3e", "comment": "Malware payload", "value": "9c2afdd861c63815f2c6d6d768cdc51b7300ae180d1870ee4ecf55fadfb1b477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096058, "uuid": "b5ff3d6b-d1c6-4e42-b1bf-82701b52b6d5", "comment": "Malware payload", "value": "75b866277ed1a5c3710ccf97949a8f505a847e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096058, "uuid": "2ad7b7b0-131b-4fa2-805e-66354c9e9280", "comment": "Malware payload", "value": "32382068c317b5da92f7270305e5481327fe68283536fea6720c390c877355c7b0907a31747c7eda776bf033a77facf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096058, "uuid": "906b7e23-19a5-4a8d-af5c-a38dd9f98e15", "value": "T1AF04B5583647A9BEC97F487D9C600CD07A7CAC672242A7079D8EF4E8393B7819B051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096058, "uuid": "e16226b1-ee52-42b9-b6e3-8d3e9d382a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096058, "uuid": "4b23e9d6-f53f-4135-9e8b-5f25fb713512", "value": "3072:1+q+QCHqAkI0MrYsUOVxm6usHSWE04YKw2tgFXJ58e8h8:12QIkI0MrYslyWE0j6tgFX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096058, "uuid": "e957241a-d613-4d30-9824-d7d805a2d60d", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096058, "uuid": "73006979-2a7f-4fd5-9cd8-97f482624409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096058, "uuid": "d4d0a14a-b4e3-4575-be0d-babae14498a6", "value": "decode_f5a6603f52d9f3101ae763b2ea5fa246d38cc261ed59e91286d0d73715b7dc08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b37f00f-4d3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694062433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062433, "uuid": "63ce4f3c-afaa-4e64-b0a9-680cca487a09", "comment": "Malware payload (Formbook)", "value": "9aea02086daf94dfa68afe47732bb5c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062433, "uuid": "368bafae-54ee-478a-a6b1-b05ca9910688", "comment": "Malware payload (Formbook)", "value": "9c90d5758f88565da1d008788a72d45ecf2a24bac0253b31620e5eef95efa759", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062433, "uuid": "28750a90-d3aa-4c37-9a5d-a6748c539fbf", "comment": "Malware payload (Formbook)", "value": "4511a4fdb7ada73fa1de7d2e1676c910b4127c66", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062433, "uuid": "47242d0d-97eb-41b9-9c7b-452e2e865ccd", "comment": "Malware payload (Formbook)", "value": "32e092b5f4235568ee60484012f968af36e630ea243eea36622640165626a82657517241538eee5e028304964a6cf731", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062433, "uuid": "53118924-1db7-41c6-be3a-a3c68ba459c4", "value": "T11743146D834F02A9CF525377AB1A4A4942FCBB3EB34452B1346C833533EE82D55256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062433, "uuid": "40ce1762-6b44-4819-8279-b27c12e88f74", "value": "768:XwAbZSibMX9gRWj/3vDVaWJdx11zOHYvpbLi7nRdNw2SE23A:XwAlRyDVaWJdx1VOHYvpbW7Ro2SEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694062433, "uuid": "56774463-759c-40c9-a427-66de073a59be", "value": 59769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694062433, "uuid": "f9b1d18d-6e5b-4b94-9d6c-da1597e43908", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062433, "uuid": "0f6f8bb8-d25a-4d54-a884-d287b0923031", "value": "9aea02086daf94dfa68afe47732bb5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e0d60c-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075824, "uuid": "1845bade-1e66-4a9e-b6c6-43401099cc7d", "comment": "Malware payload (ConnectWise)", "value": "d3544d418245cb5a9c18cb4ac5f079ec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075824, "uuid": "58675140-4dcc-4a17-ba5b-5fd3b39eba2e", "comment": "Malware payload (ConnectWise)", "value": "9cae89d57cf736583b953727bb12725031baa9a965a0a800d168ed6689dbf5dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075824, "uuid": "a946c487-6e40-40f0-bb90-6635b41345a1", "comment": "Malware payload (ConnectWise)", "value": "4a3eb6d250a31b523442ae6db753571101f6398f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075824, "uuid": "19f8dd84-227e-4f17-9d00-80056c34ca9f", "comment": "Malware payload (ConnectWise)", "value": "034945c5b1e8ee2516663dad632c57ffc1457296d82ec799c1e3f76968c0f8b451e925b18fd13cd37df6a6c96c6819f3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075824, "uuid": "eacc64b9-f05c-4f31-b5c7-5b46835f557e", "value": "T16F836B13B4D18475E8720E3118B5D9B4993F7E114E648EAF2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075824, "uuid": "6c36e17f-3825-4fe0-bd1b-8204822d1919", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075824, "uuid": "60a112d6-fbc9-454f-bf1e-497bdd730922", "value": "1536:mazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYh709Px30Sc:6FNpo6rIKlUE8fbkqRfbaQlaYYhYxESc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075824, "uuid": "ebb51da7-bbd1-46c6-97e8-e82f13005365", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075824, "uuid": "8e4cc86e-3313-441c-9df6-9684d1a9759a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075824, "uuid": "71c8e833-ee22-4c09-92b4-89566c9e430c", "value": "d3544d418245cb5a9c18cb4ac5f079ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e58334-4d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694068975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068975, "uuid": "8ac28135-09e8-463e-b74b-3ce78ab15239", "comment": "Malware payload (Amadey)", "value": "691aa23ff88331a3ed56f8e9084291be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068975, "uuid": "f936ea5d-fdca-4fba-bb06-e6b54dea1677", "comment": "Malware payload (Amadey)", "value": "9cca8061f28e465c85bef8814ba90dedf2a7731396b1b3f219b8072734cdccee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068975, "uuid": "c77f5c7f-2190-491a-ac17-8d26304fbb5e", "comment": "Malware payload (Amadey)", "value": "a2a9f3cfbcbeabafd71e3a816ab3268aebe8d3c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694068975, "uuid": "7a99e538-2439-41e6-99e8-dfdd6bc04c2a", "comment": "Malware payload (Amadey)", "value": "391bd2fb5004f3233b3598fdf87658e1c131731bb827dd28fffa55b56c3a0c403ed78e300e567155dadd5438f0a66220", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068975, "uuid": "aa1ffa3a-c19c-4004-a767-61fe7774465d", "value": "T16B44CE22B6D1C073E16752384971C7B51B7BBCB25B61A5DF6BD42A3E0E303D29A7130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068975, "uuid": "ce7be987-3750-4245-99e5-5c839db2600d", "value": "b47cf3c5038ad34425cf7f361b3395f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068975, "uuid": "ef9c5caa-1b10-4699-90ce-825a4ec57574", "value": "3072:YgXbn/ggFf2rXES6XNw3gMoycGTXfSajYSmtAU+T7YM4iws9ms0IAeCkKF4:Y2bxZ2rUXw3Joqftjtm25vt4zkfAXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694068975, "uuid": "fdcaff66-7975-4545-a361-ca993ef0410e", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694068975, "uuid": "92b5e950-4d55-4cb0-961a-03e73a78f3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694068975, "uuid": "d0079ed1-b722-4e9e-a6f9-7a3a165a4866", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e8612c-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075817, "uuid": "59239a66-e0d1-4584-b587-aa5d3caa5d90", "comment": "Malware payload (ConnectWise)", "value": "6309579ec4d7e8fb835eedc0a5e6d6ac", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075817, "uuid": "3ea18c68-5369-4640-90d0-514665cb3584", "comment": "Malware payload (ConnectWise)", "value": "9d05467c461330c3d9a71c90181af804f56cd6b15c83f2b337f928fd86ee9e09", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075817, "uuid": "813e682d-f192-49ce-a605-e6479af27eee", "comment": "Malware payload (ConnectWise)", "value": "c0d00770fb094456e7a097266af88b1bb5774ab9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075817, "uuid": "21c3f4bd-f0fe-4903-9f26-021c62592c33", "comment": "Malware payload (ConnectWise)", "value": "f43e22d1ed383f3c3751ef9556207daf3944e7315da1953ba859a482767860515dc12fa971d865ef99176a1802a1f7d6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075817, "uuid": "5e546a48-fb6b-4de3-9f89-e9edf161f8f8", "value": "T13C836B13B4D18475E8B20E3118B5D9F4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075817, "uuid": "d37e7a31-1440-4395-85d0-01ecc643ec5f", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075817, "uuid": "ade5752c-36bc-4d28-bafb-80ac44300d56", "value": "1536:mazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYh709Px30S3:6FNpo6rIKlUE8fbkqRfbaQlaYYhYxES3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075817, "uuid": "52a85b1f-d596-4f24-9940-c95bec2892e0", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075817, "uuid": "3f2f439c-b09e-4d01-b5de-fd8ef60b677d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075817, "uuid": "d9755b9e-514b-4b45-9049-a67a33970725", "value": "6309579ec4d7e8fb835eedc0a5e6d6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb6408f-4d39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694062142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062142, "uuid": "ab3feb45-b21d-44c7-ac17-121aa467d9b4", "comment": "Malware payload (RedLineStealer)", "value": "7df82986a2fb8b790677158aa1193582", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062142, "uuid": "1d76cd41-240c-4f44-9e1a-de0b932126bf", "comment": "Malware payload (RedLineStealer)", "value": "9ddfefb536babc1938301bde712e14676e3644dfe2344e9dd67063a493a3e907", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062142, "uuid": "8d93be65-f49d-4724-9cb3-2edb66a13544", "comment": "Malware payload (RedLineStealer)", "value": "5a2c551fc4b4930ca0c20724ce31d7e503dd8ee0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694062142, "uuid": "04465537-894b-4100-9613-6696f09defc9", "comment": "Malware payload (RedLineStealer)", "value": "14b9099423ba9be3547fd5e5e32994ae207932d6972c89d4f00259524f289559045bef65db97a57f6ce0409bf4038406", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062142, "uuid": "d8695a46-475f-4db1-ac5b-0322af8cb639", "value": "T18684D013B9C0C971D53114351AE29B70693C7D206B768EEB97982F2D6E301D1AB377A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062142, "uuid": "bf85b5be-4239-4829-a492-5a3d9a7c772b", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062142, "uuid": "32a07f88-ff70-450f-8de2-76b916f871a3", "value": "6144:461E/QSnxoEMTlXEulocRT+tj1VM6i8OoXm16kM+haMlDdV:46ErxJMTtEul9T+tjXMB89E6k7nlDdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694062142, "uuid": "4848d985-8603-43e6-b0f5-4ba865bfc325", "value": 395497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694062142, "uuid": "b2020996-0d64-45c3-b886-85f449b495cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694062142, "uuid": "cba1899d-87b1-4125-9c5d-1584f2bb9a78", "value": "7df82986a2fb8b790677158aa1193582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e096ccd-4d63-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694079832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079832, "uuid": "f3591e54-ec2b-4716-847f-ec5e8d239dca", "comment": "Malware payload", "value": "199a78d20ff1467606c8c9cab1c57e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079832, "uuid": "4355f9ef-84ce-44f9-a539-976167def134", "comment": "Malware payload", "value": "9de12585e11bd850783fd91b0c0ca1cd5ee30637ba7c59c011b35ffbdefe9f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079832, "uuid": "c0c26654-1bf2-4290-a1b0-bb0823fab626", "comment": "Malware payload", "value": "f741ad4c4bff684906e1d9455ba3c90e111ffe17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079832, "uuid": "c4e10c97-83f1-415f-a92a-2d27ff569749", "comment": "Malware payload", "value": "2ed4b7882ddf083d02f19f739af8d27ac8ee8692d79dd267e1aa0900ab7208ee097a00445855b9b6f2f7e3041719c884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079832, "uuid": "ccdcc1cd-6136-45a9-a7b3-d5be65091092", "value": "T17584C503BA8789F1EA8C57F6C68BC40413F0DA82739BEB1A798E23955847776FC05617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079832, "uuid": "31ba79ce-6a47-48d8-8d2e-f8c4e3b130fa", "value": "6144:UU2uSNtkPG8oB+5iPMPxTtNIW0DWSDRcICyb:D2rjTf+YPM1T0DWSDcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079832, "uuid": "38828754-e11e-4ac4-8c4a-bfcc9cdc0cd9", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079832, "uuid": "7637539a-fc3c-47c7-97a7-f464d5b8312b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079832, "uuid": "0640c049-e5a4-452f-9398-3c3f0098d3aa", "value": "Yulzz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a1c22e-4d6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694083596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083596, "uuid": "e8c692d7-0516-4d00-b140-0cc23a490228", "comment": "Malware payload (Amadey)", "value": "b2df01de36eb9eaa03730bf0ad2040f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083596, "uuid": "b222f2e6-73c2-4ae2-9e7b-bf8a76bd6e1f", "comment": "Malware payload (Amadey)", "value": "9e5323b220e3227087b6ee534826a23432c6d9926804e12222e3f3701b590a9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083596, "uuid": "da09ec69-aa44-49be-ac34-69d07daa56c8", "comment": "Malware payload (Amadey)", "value": "ee9b7fdd3ebb1f5723b7c7a18d4f47751b0b1903", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083596, "uuid": "81f4b479-15ec-4246-bf6f-025b3a45e3a7", "comment": "Malware payload (Amadey)", "value": "c8863d6cabc417febb07acde2c369cd225450115e538933806a841e09a2e59420dddd74ec271829c0e18a455dca3e6d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083596, "uuid": "3767faec-e1f0-441a-bdf1-7b0bf2fcee87", "value": "T19024F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083596, "uuid": "3ffa6710-a583-482e-9ac7-4097676a0b60", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083596, "uuid": "15485a9c-dfe5-4a3d-8dd6-7bfdb80a7997", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083596, "uuid": "00d19573-51c6-4c1a-be7b-aabad798dbc4", "value": 226052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083596, "uuid": "d91f9af0-1e78-40db-84e2-6257a50c2923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083596, "uuid": "6bd7daed-5693-4a7f-b48e-5927346c6b2f", "value": "b2df01de36eb9eaa03730bf0ad2040f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ac64fd-4d72-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694086613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086613, "uuid": "f75762ed-e11d-4820-956d-e1eec7caa218", "comment": "Malware payload", "value": "be48b31db41eb158eba38855bbe121fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086613, "uuid": "3c878cde-3808-4f02-b104-b88c419c8e03", "comment": "Malware payload", "value": "9ecac422116c58e54fe13b5dd7c42fb20b882b1d53773ebb97c8fdbb5181c265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086613, "uuid": "187aacbc-86a3-444f-99ce-64520cde1b42", "comment": "Malware payload", "value": "8ddac3c926a94998b3f69ef45b0ce4566b86938a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694086613, "uuid": "ef9f62f9-af2a-4ce2-993b-b146da2bbd14", "comment": "Malware payload", "value": "b0cb4dc9f648f370bbd00991e285e7c85dfb5bab2e2653cf514f985cfa230a808c995cf28a52746db9d377a7afaaf0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086613, "uuid": "940f3eb2-0ff4-434e-b668-5b9a5893e85d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086613, "uuid": "71dee815-f2b1-49cc-af0b-e2ca94e8339b", "value": "3:uPlRt/5lN11C111111111111111111111111111111111111111111111111111/:ud/wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694086613, "uuid": "2ee2a953-a586-4006-a219-1b6065d88f32", "value": 1371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694086613, "uuid": "57a3dbd7-812b-4558-8cc2-dacf38806ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694086613, "uuid": "3ff9218a-e9b7-40dd-a75a-ceb9ed643cb9", "value": "ARCHIVE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2b610f-4dac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111555, "uuid": "0a0fe0ae-b9dc-4c09-8d65-44904cc039f6", "comment": "Malware payload (BumbleBee)", "value": "f61cbfa1809a3c8dae3dafee8fab039b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111555, "uuid": "0e89a5eb-a179-42b9-a159-ea58446fc63a", "comment": "Malware payload (BumbleBee)", "value": "9f6e11bd6d07852d67b6469eae09fd09b71c30db02668c2d5838dfcd6cb33f1c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111555, "uuid": "8deb612f-1081-4d6e-99cb-1f513d7f2ef5", "comment": "Malware payload (BumbleBee)", "value": "7d18d1cc72e41478de90fb44368a5d30a936e38c", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111555, "uuid": "150e588c-cbf2-490c-b551-c710c23741b6", "comment": "Malware payload (BumbleBee)", "value": "49cdd76d62864fd5b56cd087ea23756cd0d4f3b4dd0fd44fbc84f083ff75e3c679345c53d21c927b29a2aa9b0e8de4d5", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111555, "uuid": "2aa9b1a4-f07b-4fa6-99e2-e0755812c226", "value": "T1F8213A0429DA1B21D377BB3B487A831689677893FC71CF1D0550858C291AB01E9B5F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111555, "uuid": "e2e04642-671c-4130-a777-3a69e5a23c43", "value": "24:8wLJtnyUlVefRXcmlz3Lotbp8DE9kI4I0W5/2lC:8ulmxbqbSZI/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111555, "uuid": "195bcdf3-8498-46cd-ae37-d63ef86fc185", "value": 1194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111555, "uuid": "eb9a5756-3667-4c03-8ddd-6bca2ac73f27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111555, "uuid": "5fd641c7-dfbe-4130-ae21-e15df099e889", "value": "482.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a140c86-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694085141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085141, "uuid": "40ca0d26-bc07-4aff-a8fd-33c0de981d76", "comment": "Malware payload (Cosmu)", "value": "f7bd0591355ff70e6c1f67bbe9c5d9a5", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085141, "uuid": "784db3b0-49cb-4ce9-9176-664fdbc05fb4", "comment": "Malware payload (Cosmu)", "value": "9fbaebc2b78b0e29f3f3756a443fc7f84aa5cf339edf07c783a47fce3a683c15", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085141, "uuid": "3a2a3d9f-2971-4a3a-a00e-7249baf39a5f", "comment": "Malware payload (Cosmu)", "value": "cd9e6a357620bd1d12ba2667e64bfd67f526b49d", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085141, "uuid": "e5b1cc7b-8725-49a1-80e3-68573729660f", "comment": "Malware payload (Cosmu)", "value": "bb579d9c8c1f9d01a929073b6b4860bbea327516818428935bc31da0fd5945c4a00e9b18c3442b45ddc91447d405d5df", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085141, "uuid": "89542bba-d9cc-4bbf-b3c0-179fa6ec2bb4", "value": "T1B4847002E5B6FC5FF1FFF3F0D52B311C2EA2DD59A68088019DF0918992B7A6159992C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085141, "uuid": "a9cfbd17-6674-41b3-a671-c25e50aac252", "value": "8abecba2211e61763c4c9ffcaa13369e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085141, "uuid": "557a673f-78f9-41cf-9c42-6522a6b45411", "value": "6144:RqlIyFESWu0SWuiF0oZoAwq1afhcD5sMjif:tyMFtwI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085141, "uuid": "f2cefaef-c48b-4b7a-901e-bae1429a28cb", "value": 403428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085141, "uuid": "c0451449-3735-4338-acf9-8e8e789332bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085141, "uuid": "1991992b-aef7-4ecc-8be8-1903af8c008f", "value": "Trojan.Danger.ATA_virussign.com_f7bd0591355ff70e6c1f67bbe9c5d9a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333fed96-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096645, "uuid": "77e6b786-8c3e-417d-98dc-ddc4c625ea53", "comment": "Malware payload", "value": "4d65b8c922545036b3f630f0a39e0293", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096645, "uuid": "75611c8d-4cbd-4ca7-9bbc-797ae60a7183", "comment": "Malware payload", "value": "a00beaa5228a153810b65151785596bebe2f09f77851c92989f620e37c60c935", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096645, "uuid": "f43e5d0d-92c6-499a-be04-2e83c7feeff2", "comment": "Malware payload", "value": "69927ef12831a9944cb3df67de45712495cd9cf4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096645, "uuid": "156e414a-6e88-457d-9b4f-e4c83fa52676", "comment": "Malware payload", "value": "b7c5fe8fe3ea0a90d8e9c38a6d5000869555d5a87ceecb1ce2ef640c068ed898909c0d0446de25168060ea23671c2af9", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096645, "uuid": "6697c318-18a4-4ff0-afca-d5acbfc5838d", "value": "T1D4D5BE02FD058E76E01D967BC1EF8104C7B09C5226E6E617395EB2EDE2093A72D4E5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096645, "uuid": "28a3ad1c-d37e-4b76-b27e-c3b7740bec6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096645, "uuid": "c7a3f375-fa6c-4592-9e02-eafd9e01621c", "value": "49152:1pPcemJq4nfV+lILEs13oJwhvpT0ZYyOTRdrO6229kj6u6t5r:1Oee7fElk1V0ZErT2Okj6D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096645, "uuid": "8948d889-f406-4ae2-af2f-eb7c63597d33", "value": 2874368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096645, "uuid": "c593eb41-1e07-4369-ae4f-0b88a9e97eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096645, "uuid": "59c7d8be-d142-4c50-99cb-8ff9e8b9525f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c828384-4d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694082514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082514, "uuid": "8d93ff66-e256-49bb-ac26-019b782692df", "comment": "Malware payload", "value": "075c37f1a4ff172ff528ee33282f5a59", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082514, "uuid": "8ffc269c-8719-4976-bfe8-96ed8592386c", "comment": "Malware payload", "value": "a15f06195ccb781018038c8f62e0ced3629c760865fb44b3a25d7c940c3a1540", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082514, "uuid": "7b290fb2-05d2-4636-9872-db9ac1d1f8a7", "comment": "Malware payload", "value": "cb30361ea35be80311d2e403eaed19ffa59f6c0d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082514, "uuid": "5c21343a-c79e-4663-a980-855019beec8c", "comment": "Malware payload", "value": "43b2c8e51111fce150f685e0f7c4a1a16354b42c715bd79a1690af81dd03c788aa4fa7a7da2d60a4a30caed69887b603", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082514, "uuid": "f383ceef-c609-47ef-bee7-455b9fe5e099", "value": "T167342A23D1A31CDEDA2EC27946DAA3717675FC213127EA1B4B34CAA41F91E70772A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082514, "uuid": "48c12deb-f5f7-4090-971a-6a00404bb5b3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082514, "uuid": "a159a70d-c7a2-47fe-af1c-e89d2123a132", "value": "6144:12ZjwB1CNMtkXqbRPa4PsXriauVpCb0VadK8KI:12ZjcCNMVp5Ebpu/CIVadK8KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082514, "uuid": "9ef41e2a-1c6b-4cf4-84da-731c4fb7edc7", "value": 243139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082514, "uuid": "10606b87-a4ef-462c-b5d3-afb8aaeec7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082514, "uuid": "454e81a1-bccd-49c2-8c5a-eebf329e306a", "value": "075c37f1a4ff172ff528ee33282f5a59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2f6513-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103292, "uuid": "1aeb8d31-1b4c-45c2-b2b0-b70af75ad34c", "comment": "Malware payload", "value": "b046778ac326e436d8f8a4f6a7b5795f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103292, "uuid": "07f5e640-72eb-4ca6-b86e-bb4a51db3f72", "comment": "Malware payload", "value": "a1ee9494813919b11b7c19220f2a491c32153b51f2d4adc7256ee04b5c3b4564", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103292, "uuid": "dcab8a40-a527-416c-90a6-43de73a9e0c2", "comment": "Malware payload", "value": "616034aa450c80961ba80b63720b004228ab9c0b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103292, "uuid": "e86158cd-9ea7-453c-9cea-5e8abeb78efb", "comment": "Malware payload", "value": "2beec49496a9c9ba795ffef24a53088881ce8651eff653eb911364201bc1d1a1d796bf9cbd0fb4b4bff152ca13e9b8be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103292, "uuid": "d6f078c3-225f-4c76-a16e-01f62bb23e41", "value": "T1F9F43305A3160A5AFDD3F8DF43E56043CB0AE4304FA7FAA3D5B24DD464698FD42A168B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103292, "uuid": "60764806-49dd-44fc-b526-aaf6f87889a9", "value": "12288:Voe4a3cc2BWg/uziPazZiN0S/9hUDVSB9aY0IuE69uaxHrS2l9vnwBAgcsUEPTxi:VoP4cc6Wg/E7Yz/3ECIY0IKxtldwBSsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103292, "uuid": "a94228e1-6974-4fb5-9100-b2650e6fc2ed", "value": 749154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103292, "uuid": "95cf6124-8cd0-463d-b61f-3af8e90427ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103292, "uuid": "47c116a6-9319-4d2e-a98c-f6153db3559a", "value": "PO-72201.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d22dcf-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075584, "uuid": "f00f1230-16a6-4483-9e6c-3061ffe28f07", "comment": "Malware payload (ConnectWise)", "value": "30dbd8d45f1f0ea1c9c4a41f0c402380", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075584, "uuid": "8c6cfee8-e368-4fd7-b85a-3a353097aaa6", "comment": "Malware payload (ConnectWise)", "value": "a1fb294b2b45d11325de86e1ea1afe806db1bb059e2a08c012eab8426e61eaee", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075584, "uuid": "967d8c85-da0d-4f62-9023-859e33289151", "comment": "Malware payload (ConnectWise)", "value": "c6586f14bbbdf073dc8aa7f0a127f6db73bf96fa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075584, "uuid": "3afb59af-47d5-4374-8d2f-2356bcec5adb", "comment": "Malware payload (ConnectWise)", "value": "3f8e24110d1f660660da308121ebf34d8723828016f05d623cebdf93cdb309736eb321af3d2869ee87f14b2884a36698", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075584, "uuid": "a228d304-56ea-4542-b4cb-7d96fe45afc9", "value": "T132835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075584, "uuid": "2949a500-1a8a-4511-ac13-1c4a8130977f", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075584, "uuid": "c87dedea-ecad-4ad6-b467-4f2730ade851", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Qk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075584, "uuid": "3205f274-291f-45ce-9a1f-0a1080395bdd", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075584, "uuid": "3986a11a-81a3-44c9-aa14-8d966c56dd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075584, "uuid": "805b3541-147b-47e8-8afd-7f5b4ab69002", "value": "30dbd8d45f1f0ea1c9c4a41f0c402380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f361ca-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694081486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081486, "uuid": "bfdead6f-31f7-4de6-b97c-424a96548083", "comment": "Malware payload (Loki)", "value": "81163ccd9ac21518210e1f9119868348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081486, "uuid": "1f31f07e-a2b9-46f7-8f0f-fe725eb2ff10", "comment": "Malware payload (Loki)", "value": "a2014c198d0231ad1c910cbf03b2c9b8f58b71dcf7e29d8bcc709f6b5e10d2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081486, "uuid": "31b32685-c583-459c-96e3-bda17139dd71", "comment": "Malware payload (Loki)", "value": "b81d727a3f7ccba04ffe58880d57daa84c2771a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081486, "uuid": "d78801c6-fec2-4a3a-89dd-5a60e1586e39", "comment": "Malware payload (Loki)", "value": "e301c3c7d6a8b5b0d9697d79cfea48aa32dd800d1f548fa4d50d1f8a365eaddf72f797ab7b1d2e4ad1096f352933ed1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081486, "uuid": "16c1c197-5628-4946-84a0-5acd0f31ce85", "value": "T182F30226FAE4C5B3E95116B06B7A9347BFFAE5070069520B13806B4A3D762C1AF4F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081486, "uuid": "0b56fabf-b368-4007-916b-165ac88bc66c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081486, "uuid": "5f3e9f5b-3e92-4c7a-93f4-669f29f7fa95", "value": "3072:3fY/TU9fE9PEtufbRn5BQDtKpvi0ta1Npn0nCpTa6hSUfFfgDuqTilCCGZnjC:vYa6Zr6op3aLF0GjDfFf0uIilGZnjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081486, "uuid": "bbaedcd2-f67a-4916-a7d2-949da3673ab5", "value": 168886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081486, "uuid": "67fd1343-5462-40d8-9e47-5ec6fe3800de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081486, "uuid": "77ee55f3-25bb-46f2-8bb9-1a4444ade26e", "value": "a2014c198d0231ad1c910cbf03b2c9b8f58b71dcf7e29d8bcc709f6b5e10d2d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64b7ef6-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694096060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096060, "uuid": "48c20e5e-aa79-4e44-84c7-121e569bdfe5", "comment": "Malware payload (AsyncRAT)", "value": "1a29135fcd760e81c4737d8086f3f60e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096060, "uuid": "7bb0275a-2b8a-4eac-8cdc-d3da78770402", "comment": "Malware payload (AsyncRAT)", "value": "a214fb49064cc1516a7df9479a32e9bb8fe12996d44eef6d761f9a2e7d2b5091", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096060, "uuid": "4d68b24b-243b-44b4-84cc-ab1b005a8990", "comment": "Malware payload (AsyncRAT)", "value": "79812fe3fad0806f55818cd54abcca486c4c1cdf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096060, "uuid": "705ac9ec-c6b6-4f31-9288-15a9ad801464", "comment": "Malware payload (AsyncRAT)", "value": "1f5fc76b7936448ddfc5cf890f31e57438ab22f575947f978b903434ae1f00d477d8cc70c0162b7dd4675a2c6a87a732", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096060, "uuid": "b11231e2-b158-419f-983a-0e72615c8281", "value": "T1AC53F8013BE98029F3BE8F7469F2618146F9F5AB2D12C55D1CC915DE0632B829A41BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096060, "uuid": "1b091e15-f963-488d-b26f-60172672e5f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096060, "uuid": "4c25a86e-fd0a-48bf-b3e2-9361b9d69de3", "value": "1536:7mImJ6tX2kNff4sKu+UYFeKGwoVd7b+APGruB4ZkSrPlTG9x:7m9J6tmkN7Ku+UYFeKId7b+rKB4ZkSdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096060, "uuid": "e81e3d75-0d88-4af1-b5d8-3093b7336025", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096060, "uuid": "0e9620fa-68a0-4140-a8fb-b68ea03370d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096060, "uuid": "7918b7da-c732-4282-be7c-c683c6f799b8", "value": "decode_f7d4825cf01b8b9d9ea7ca76eaee48d2091d43e26915ef9a158335157e833489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ed69ee-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096051, "uuid": "e3bde700-7158-4980-ac7e-eb6a5d50cc9c", "comment": "Malware payload", "value": "f234c21ce8aedbb843edeada03530031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096051, "uuid": "01f98b2f-df2f-4e0a-8f59-79fc73553d71", "comment": "Malware payload", "value": "a236605ee5b5e7b7d966078a0e08e85e94022622e180e7b75f47ed97ea1a9c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096051, "uuid": "675186d1-7d8c-4ed6-961c-8a0892a8764b", "comment": "Malware payload", "value": "13f60dce311849b2e7bd1dc4633c36560625bb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096051, "uuid": "0d87ecbc-6dce-4557-9b5d-0d04e2ceac8d", "comment": "Malware payload", "value": "49b2936b05c0e1c861159aa87dd545a6259389c775a6ec6d5a9558ed155797c585cc4ac7a90d8cb85d6a4b87f16340b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096051, "uuid": "36db654b-75e3-4271-89e6-ca0e209e3393", "value": "T12B334B127215C032D856183518B8C3B29B7F79325679859B7FE817BEAFF02D05A383B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096051, "uuid": "ef1c8acd-3ce8-4236-a30e-8bb9bb4737c7", "value": "44d2692c65cbefa62859e7ce11b07911", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096051, "uuid": "5ef6a9a5-cbe2-4ad0-807f-e70147ab8a97", "value": "768:16WGewfJG/FajP7bvUZRwsuCXP/P8HF5uh6M0oiBQPk9WEDxXn31Vmniz:4HeTtrACX0HF5if0oyQP27z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096051, "uuid": "8d06a435-f462-452d-8dff-22399d9f2cca", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096051, "uuid": "fe31a3e8-c7d1-4119-8438-6a84b25ba8a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096051, "uuid": "528e313b-d0c7-4ed1-a464-409f278bbb21", "value": "decode_ea91fc6a88c0545e001a4beb72dfbe2cdd81dee0539ecff5518d921608a02ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05f11a2-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096023, "uuid": "10b12396-d0a0-44cb-a671-e51332307408", "comment": "Malware payload", "value": "269812c6cb23d1555e670c17d3d9c1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096023, "uuid": "31dba07d-b387-4b20-bc00-ff19591e981f", "comment": "Malware payload", "value": "a2762ff7d8de94fedbdbb77bcde328a6a55b98b39a80978a0179549349123b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096023, "uuid": "51985541-ddc4-46b5-9bc8-cb4be32895dc", "comment": "Malware payload", "value": "4fecd4f2d810b0e188393963e72ef523c5ae6f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096023, "uuid": "0c4d9dac-3064-460f-aaaf-3a425404d9f2", "comment": "Malware payload", "value": "c1fe4829f005357cc27bb5cf57e8f40641678b0828bb232daf69c2701358b2e988173ccceb7fab335f93e9a07540505c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096023, "uuid": "09efb3ac-4eb7-4a8e-a559-96964f622b04", "value": "T13204C4583647A97EC96F487E9D700CD07A7CAC672246A7079C8EF0E9393B6819F050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096023, "uuid": "e716ef5f-3a6d-4dca-9ed6-081784458935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096023, "uuid": "2b6c6189-2df0-421c-ac4f-bce291bded0d", "value": "3072:M5RHUdTDfI0BGdA2OZ64DXbtxxa8E0CqEYi/hxT2Jx8e8hy:M5RHafI0BGdAvp3zE0Ni/hxT2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096023, "uuid": "c8c5e60d-9385-4041-a27f-c0782da0fec2", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096023, "uuid": "49427274-ec5d-4d63-81f9-9a1e6b667270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096023, "uuid": "854db4cd-0875-4f7f-8af4-c9309b86b534", "value": "decode_3e83cbdaa5bbccad523d979627ed01aed35d54795ab5e97cf889b47b242cddbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7489e5af-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694069267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069267, "uuid": "a214a4bb-5553-4ff7-9e93-dcc10d853758", "comment": "Malware payload (Formbook)", "value": "9e05137b1d228061562c75edc1cb3de2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069267, "uuid": "a7d92daf-df9a-4627-a713-3882e5d0d4c5", "comment": "Malware payload (Formbook)", "value": "a289979e75a6254869afab2e0066bcdc82f3e862ba29abf31f1eb99c90b54e28", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069267, "uuid": "f4898b0a-103a-4650-8616-6c41520381fa", "comment": "Malware payload (Formbook)", "value": "a097eecc4c02176c94f3e8f0891c837abecc3ac6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069267, "uuid": "3131c451-e5fa-4626-8e6f-900881829abd", "comment": "Malware payload (Formbook)", "value": "575738006b52cfea9e1d007f7bf280abcabb606cf6accf9f44307579337d1d4e18d3a2dca4148576efc5973faa32d9cd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069267, "uuid": "f41b812c-e485-449e-a26c-eb5da7acbd7c", "value": "T15DD423B8B7F35DCECE4FC0625229513AAB796B8D1E5DEAEACD93B0CC141038116170A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069267, "uuid": "930e14ad-7297-4b94-8b51-156f8490d5ee", "value": "12288:40e/i1il85vy6y2GQlpNINsicVy5Fs4Y7B6BAyJraIIJqu4zQhtK1ju:40xilkvyfQl3isNo5RY7ZyJroJKhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069267, "uuid": "f6b1e53c-0402-4883-8120-7bc497e7e4e1", "value": 634312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069267, "uuid": "313933be-1873-4380-9777-ca91e331c7a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069267, "uuid": "aad8f880-8079-42c5-ad14-35d8bd9a7081", "value": "pol.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c6f295-4d77-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694088652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088652, "uuid": "d971fc29-84af-4694-bc09-e94a6803800f", "comment": "Malware payload", "value": "50b62af65da147ee602a55a596fad33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088652, "uuid": "18c35eac-8cdc-49a7-9166-c8bce7bfa597", "comment": "Malware payload", "value": "a2c78991fda9f204657dec45db339110368891626d794fc90affa10e09776671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088652, "uuid": "53e907b6-e35b-4f0c-a221-dba8f574d4e9", "comment": "Malware payload", "value": "68e8ffe2af2524586c290bde04294d65aecd2912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088652, "uuid": "e4f73944-6f20-4885-85da-223c5b4e2ac8", "comment": "Malware payload", "value": "5066cc0e9fba480ea39c3babb969bc72b61fc0b9ecfff84f8a3862a2d1a1fca7ec52889cd287588b18f910c86fddcbe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088652, "uuid": "b1b732c0-f0b1-4e31-b5ec-5161972030ff", "value": "T1D504DF31827E45ECC0825D7B20441A3282EE194FDB299EF2BB59DFE26DDB601B3451DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088652, "uuid": "b7553666-4fad-4e5d-a182-069850fd0e98", "value": "ebf39a4c6044b27997487277e5b094b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088652, "uuid": "bb34ea96-f135-433b-93a0-a7363c10c470", "value": "3072:DXqFflPGiRnFYea9pxttSZrsYJDs1qVXl6zmhoSk64TgG8ax9LjimrU2IG8uF+f:2FdPGIcpXMrpJA8bmSk6md8siiwGLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694088652, "uuid": "acfe1ff7-1c44-4d32-9594-fa9db947bb54", "value": 175768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694088652, "uuid": "7a116b36-4f3f-4ee7-b4e7-6306df35f456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088652, "uuid": "94e7e064-e570-4b63-aad3-85eb53026af0", "value": "a2c78991fda9f204657dec45db339110368891626d794fc90affa10e09776671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cbe25a-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085191, "uuid": "c452f8e9-aa21-4472-8b9c-36824668a1e4", "comment": "Malware payload", "value": "a22aea9cf6a878033880f74e1633e974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085191, "uuid": "7f3e652e-dc50-4298-9ce9-87a69b0ab079", "comment": "Malware payload", "value": "a2f97814a112f145ec595add7437ba64bb66a874990fb2c5c5ced454bac13468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085191, "uuid": "cc55e991-10c4-4cb2-a2e9-58904174c079", "comment": "Malware payload", "value": "79f633b09355e11fae2bdc9bdbcf651902ae9687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085191, "uuid": "b6484171-cb27-41c4-a8d9-3bea72710e87", "comment": "Malware payload", "value": "96cb3965d7d7abd43c479b9f37e56d7f420b2d38eb257063bcc51dea0c088dba67c812a592a86649e5b000b3a797d76f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085191, "uuid": "f4bafbca-7151-43c2-81e6-d778b4af934d", "value": "T12A13D06FB38B0F72C2C3423A359B868E771BD53502AE83856829504F6ED179C6DB3B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085191, "uuid": "8a17ac76-dfc0-4cdd-aec1-ab66edf87609", "value": "3e64161cb0c3896db454cd0c61be26f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085191, "uuid": "7ddf20be-5e6d-408f-8b8a-bf75cca35b64", "value": "768:XDcAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFlEqe1cX/lzdMEOd:FKcR4mjD9r823FZyO/yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085191, "uuid": "c9224d0c-5fa3-4d9b-b58b-6593c4cb9ae8", "value": 43648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085191, "uuid": "21b5a14c-d153-4383-9869-b288f34fce14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085191, "uuid": "e337a51a-9693-4f71-8493-8d020e08c74e", "value": "Trojan.Autorun.ATA_virussign.com_a22aea9cf6a878033880f74e1633e974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdcb792-4d7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694090090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090090, "uuid": "4fe1c75a-54f7-4bd4-a7ab-c5d75bd23465", "comment": "Malware payload (AgentTesla)", "value": "acaeaf793d94696711d3453ab8789924", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090090, "uuid": "cc49f575-15f6-4cc6-9c5f-56e4d2eb91d9", "comment": "Malware payload (AgentTesla)", "value": "a350436c4c1b84c822cc9e34b556e10ff3b187f33b38448b3391f8d31623d2cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090090, "uuid": "3422543e-d567-4abc-b6b5-e1f6ee4849f9", "comment": "Malware payload (AgentTesla)", "value": "8eef18786196f96291b9b30ee9656c5d637332c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090090, "uuid": "12308340-840b-4f01-b47c-110bd382f7d0", "comment": "Malware payload (AgentTesla)", "value": "cae92066833ef76c9266c9ef53bf50c707b37fc2627138a2cac583d4eedf8b706e4703e3197f1570ebfbc46389404ff2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090090, "uuid": "f4e6900a-1015-411c-90df-39fe24c605c8", "value": "T16EE4EFF849A6CBE2E37483FF655B88B09E137D41217583DE377C31484EAAA830916D72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090090, "uuid": "e7e204f7-ed6d-48a3-935a-0bcece3afdc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090090, "uuid": "140c1004-407d-466b-ae73-295d7a1b2cd8", "value": "12288:15fVsbR2PeWF8XjDGRSIzrZiX3nAjZcLNvu4KQBUfFYyjz:1tO2vF8XjDVWZinA2LNvCgUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090090, "uuid": "b0939312-618d-482b-9f89-9bb3bc3b0b3c", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090090, "uuid": "a92dd829-f9f5-4e07-b3f1-a5038ea71332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090090, "uuid": "8fc68401-d962-4377-a048-ff8209118a9a", "value": "SecuriteInfo.com.Win32.PWSX-gen.5152.23176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db14bf72-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052688, "uuid": "6a423e85-409a-4e48-a950-4dcad586f29e", "comment": "Malware payload (Amadey)", "value": "fa02f488d9817413a699571ae79ff869", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052688, "uuid": "a6eed8ef-23dd-4c80-a018-4d4350248153", "comment": "Malware payload (Amadey)", "value": "a442b7537fdcb8d472eadd975b439e09c73820764be72c99b5632006b4cf9539", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052688, "uuid": "b72c955c-2205-43fe-91ca-03d40944e61e", "comment": "Malware payload (Amadey)", "value": "feb7a7de13d8d6b7c8605c688c110f3a226a5730", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052688, "uuid": "af8abf16-a8f1-4932-9c69-4163ce10e557", "comment": "Malware payload (Amadey)", "value": "bbe60fd068355c8017a737775c98191f46c4cb64e32489a97eaee3f8fe4b89fd1c80a5f1264760ebe6e54fb517eb8144", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052688, "uuid": "4a120064-0490-4d36-ab95-2ad837d2a902", "value": "T1F124F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052688, "uuid": "40d3850d-7d3f-46a4-a04c-0125e9b76c19", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052688, "uuid": "f04514b2-f20e-4a86-9b40-99693233cbef", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052688, "uuid": "901069cd-8b40-4213-9727-ada139607fb2", "value": 225423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052688, "uuid": "b9017ced-6cb5-495a-97b0-78b1ebf7c970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052688, "uuid": "c5fb3ee1-d5a5-419b-87a9-cd50cc06e183", "value": "fa02f488d9817413a699571ae79ff869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7d50f1-4dda-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694130940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130940, "uuid": "e7a53dff-9bff-42f3-b507-44a549a27f4c", "comment": "Malware payload (AZORult)", "value": "cb679edb742cbf913bcd6f1f812cbd22", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130940, "uuid": "583c4766-80a9-460b-8fd5-1c88783062f2", "comment": "Malware payload (AZORult)", "value": "a58e4f5943f674dcc38fe7cc692e76dafab87fc1755a2b4c5cb2e41964674b3c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130940, "uuid": "6e61032c-76ff-4b73-abbb-a9ded66636e5", "comment": "Malware payload (AZORult)", "value": "a18604a3d171bd3a396c13cfaa3a11d0ba2e78ed", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130940, "uuid": "d75bcde9-62d0-4d19-abf6-6445d75b4e9f", "comment": "Malware payload (AZORult)", "value": "fb90f1e3987b601c6328502b05bbd22bd451ce6edbecb069d279135f0201f7cd2cef13982e80c25fe4366ba74e778476", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130940, "uuid": "ddf7a682-115a-452c-92a0-b6a5a61cc640", "value": "T19594E0806B90D97FE79E0B7885F2EB7856789CE038118A0377953E9FBD21F9DE841250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130940, "uuid": "4d3dac98-500b-4c67-a646-ea73efe27a4e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130940, "uuid": "22e729f7-36ca-43af-97db-a1898c1a5839", "value": "6144:uT4DtHOOUPy5MI1RhksWkoR+zD2MGOj679B0llp8ffAKqM2Y6ulTsG42xat7MTeQ:uTeeZRMKh7PwH8nbY9ulTem5pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130940, "uuid": "ea8b318f-c6aa-4174-9064-1d13fe7b6a13", "value": 431380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130940, "uuid": "696e47fb-0f61-4251-a0c8-0911225bbdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130940, "uuid": "8b1898d3-3c53-4f35-9e8d-397534b45d12", "value": "Pterion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6527754-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1694103415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103415, "uuid": "7123b87b-8b3e-41c8-8157-8e282992c479", "comment": "Malware payload (GCleaner)", "value": "8f01f1c49e8ee0390d345a6b5d751fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103415, "uuid": "cca51f82-8c95-4c2b-8d50-c16b0aac5022", "comment": "Malware payload (GCleaner)", "value": "a58eb00dc23a5b23214a1e4db215cd00fe6ed77aeda1537ea4fd76aa3ef749fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103415, "uuid": "986ae3b1-a717-4a3c-a1aa-6907658e9d50", "comment": "Malware payload (GCleaner)", "value": "e4e2ff0612cd5c7894edb7a54f777b2c1494a4ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103415, "uuid": "8819f6e3-5839-47a3-b2b8-61405e9ead1b", "comment": "Malware payload (GCleaner)", "value": "09bf275ebebbf4b796f3fa3d555b02f71a619f5172592c862d85dcf8128a9ee97af293c312103774001ea516810c6d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103415, "uuid": "86f38bea-577d-4acf-b4a7-3bd9696831ee", "value": "T1D2848D129EA17C61E52746328E3A92F42A1EF9E0CF5577EB1354EAEF0D701E1E272311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103415, "uuid": "475fedb1-fd25-44ec-b098-4a84f5e9fec1", "value": "6200f2b320af277fec49ce04b92f1379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103415, "uuid": "dc4e610f-06d0-4514-bae8-d862dae5ecd2", "value": "6144:P6jazFSbPXhW9adSSXLNRbS0hz/hJqJdmjwzLokFdRc2YO:PqoSb/MIdVdpJYukMkNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103415, "uuid": "de640f8a-61fd-4ab6-961f-2185761a966a", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103415, "uuid": "04c088ee-21ea-497e-b689-a6e3b3199d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103415, "uuid": "c609e802-7370-43bf-a0c0-cf842429d0de", "value": "8f01f1c49e8ee0390d345a6b5d751fe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4da967e-4d46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694067684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067684, "uuid": "91264529-94e0-48d1-b300-3e8ea1a6ec55", "comment": "Malware payload (ConnectWise)", "value": "98fd563fd44af61a21fc288448dbedbb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067684, "uuid": "ef147099-d981-4808-9e53-c663c1aa98aa", "comment": "Malware payload (ConnectWise)", "value": "a619326275abbcb797c469378a1a3f11f67e3f0ba01570c8358c395dff5dd967", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067684, "uuid": "8c914f58-f9ea-4c31-8d6f-9057656e1a3b", "comment": "Malware payload (ConnectWise)", "value": "f15992f3cfb414a3ee3b9432a2d508be3e9a3613", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067684, "uuid": "d41c0345-1ec8-4c74-af9f-8a149c335d3f", "comment": "Malware payload (ConnectWise)", "value": "5ea3f37f9f832d258dbf3fc80caf812aeddf5f70cfebd0af79350727a9ec102aacb48e321680b232207ef59a62282b2d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-ptljvr-relay-screenconnect-com", "colour": "#136079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067684, "uuid": "0c04399b-8abf-4170-95f6-b5f43e274867", "value": "T11ED5013136D8C53AF2F61A39E93A91F05939BD24DA67801F43647E1E3971E8096A3373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067684, "uuid": "740e9ad3-a4d7-4603-81c1-53195f52695d", "value": "49152:wUY196CBneXpJwTDVnNe91O+6qShAn4dYdJSQrGOHolFREGxfMnRMDRQ9wl4+KEs:zVm23wTDnO1O+ShhdYdsyG3YQhWGl4s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067684, "uuid": "b7f3490b-d78c-484d-84a1-c3b59ac36af2", "value": 2908160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067684, "uuid": "f30787ec-c2f0-4121-beaf-47e13cb25aaf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067684, "uuid": "ce07e196-7a1d-4ac2-822c-8b087725f0ac", "value": "a619326275abbcb797c469378a1a3f11f67e3f0ba01570c8358c395dff5dd967.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a248830b-4dd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694130332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130332, "uuid": "bdf8d4fe-caa7-4fa7-b586-705592acf486", "comment": "Malware payload", "value": "95aed440161896caa416c2c431d593cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130332, "uuid": "763a54c8-febb-4ed3-bf0c-44c33a70d8eb", "comment": "Malware payload", "value": "a665f1fb66fab52f1aaeb93fad95aad4878c3e6bcaeb27ae8f17b97ea9008e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130332, "uuid": "1ef08155-3ec5-4ac4-838b-7ccde475add0", "comment": "Malware payload", "value": "de36316385bcf7fea1c3a92b98a50825be6fe731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694130332, "uuid": "69ba31f0-74f4-4715-8b7c-711bc6386751", "comment": "Malware payload", "value": "2bfe28c800d269d1f3d0583d1244513dd7465a64e158dd5b6dd9c4a5d951ce52fb95364322754638a5134e27002e908c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130332, "uuid": "2cdf41ec-4d50-4b87-9d24-d21234398a6c", "value": "T16016187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130332, "uuid": "25bd3e1b-ae9d-4116-af70-43365429cc62", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130332, "uuid": "6522ccc2-0096-434c-8978-983142bf6229", "value": "49152:Cgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWgjXNO:Ya71fQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694130332, "uuid": "9e069fcf-549c-4594-aa23-18ec6cdd49c8", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694130332, "uuid": "9b818135-5ccf-493e-86ad-fead0f670e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694130332, "uuid": "f02d85a4-8209-4d14-90eb-d42fe6c57753", "value": "SecuriteInfo.com.Trojan.Packed2.45650.20421.14832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc779e5a-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694085386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085386, "uuid": "329535ca-283b-4bcd-b426-1460a3620d4d", "comment": "Malware payload (RedLineStealer)", "value": "c55a1014ff28fccb363dca8e7bdfd0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085386, "uuid": "0aeb7973-ff11-49eb-8559-aa1c0411704f", "comment": "Malware payload (RedLineStealer)", "value": "a74b683d2ad793d4f91e2843ac49862cd3403c42827d3ae63336156fbcc482ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085386, "uuid": "565cde2c-8d20-4672-b95a-3e1b7ec3eb7e", "comment": "Malware payload (RedLineStealer)", "value": "ebe2c22c45c4fda1d35859895e0557465a32ab78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085386, "uuid": "dd0c4100-e30a-48da-b7ee-834ac6400b51", "comment": "Malware payload (RedLineStealer)", "value": "48fabf8954b8add17021f5bbe08f417bc3e2380f37f37a46055579bc25bfffa61071deb5f7290b527e3e85bc95d66c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085386, "uuid": "abd2abcd-dcad-4b64-b486-d6fd24d89263", "value": "T188F37D02A7E84136E9F21BB05CFA13830B3ABCB2AE75835F2755559A1C726C0D931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085386, "uuid": "19ad521c-dc96-4347-ae27-f93f4ca4f27b", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085386, "uuid": "e48b289d-61fb-4981-8e24-698babbb6945", "value": "3072:5VFRQGCIIm1xF5GWp1icKAArDZz4N9GhbkrNEk4fH7YERI8OG:bQGCIImDp0yN90QE7fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085386, "uuid": "87efede0-bf6a-4cce-a4c1-b7f7ccf6f7cd", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085386, "uuid": "4400d2b6-c01f-4327-a070-4a32aa0d8511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085386, "uuid": "2ad62289-36ab-4cd5-9b61-fba8fa73c112", "value": "flucc2(oldvirus).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcae5008-4d6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694084474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084474, "uuid": "8cd93046-0bd1-41a5-91c8-6398f0e69006", "comment": "Malware payload (AgentTesla)", "value": "572312ae6f728e3f11441ba7625a28b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084474, "uuid": "d416cb94-230b-4aae-9291-8910b9880bab", "comment": "Malware payload (AgentTesla)", "value": "a7aebf20b139e8a3943d80bc87fde8d0a03c9bc3a909a272f3d6b179c276285a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084474, "uuid": "f22e17d5-d5b0-4e9e-8bf2-e3431814c042", "comment": "Malware payload (AgentTesla)", "value": "3124b81f7180cc3cac455c823a0e49d9bcc10621", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084474, "uuid": "87a67960-968e-4d19-9949-c5779869ce3f", "comment": "Malware payload (AgentTesla)", "value": "dde82b03835378267e62b79a579dad7cc6d496546cb20bbc7b4a03c7341577078a0c9544c6736d264cfbc55acbfd9dcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084474, "uuid": "74a9e299-856f-4279-b4db-182bab9b8b66", "value": "T1232551AC7D9D5187E738DD38669F203C0C66D2126D2AA384DBB6C8D71FA01073A5DDA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084474, "uuid": "6de369e6-b4b8-409e-93d4-e76379329b11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084474, "uuid": "7eaafc86-5259-492b-a703-5e678b94984f", "value": "12288:/sZqFaV5dySWrDg5aErAbLvUzZx8wilsM9hoLcN5ZQ4vDBVevaj/:EZqMV6D+vrtkN9aLcN5FvfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084474, "uuid": "7f8c80ff-2083-4098-b19e-5ac44acc7ac1", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084474, "uuid": "a5a78b5d-9842-4116-a72c-ce047650f375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084474, "uuid": "2513a911-1bcf-4087-a17c-1d4d51cddee2", "value": "a7aebf20b139e8a3943d80bc87fde8d0a03c9bc3a909a272f3d6b179c276285a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb0fc90-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694069257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069257, "uuid": "45d94127-946f-4524-a75f-8298a95df447", "comment": "Malware payload", "value": "8f19057c24c79cfd804408753a38fd2e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069257, "uuid": "57229920-f387-4507-9515-dd0c398d37a8", "comment": "Malware payload", "value": "a87bf2227d08c9b855a3f646b958e722ac3752951b658027304e879d09e7061c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069257, "uuid": "2d2b2e16-8d99-42ac-ac9c-7b7e94b94d2f", "comment": "Malware payload", "value": "4abb164897b676a57f734662789857f3435bf177", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069257, "uuid": "7f14728b-fe17-4e27-a068-cb4edf3fc837", "comment": "Malware payload", "value": "85929c80c4429add772729e2715ac40cf9d75ede7f791d2e8a0f97a3ce4f96684b4fcf069fb7b9f29c633244fcb9fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069257, "uuid": "2c1ddc3e-2acd-46dc-831e-8edea470dade", "value": "T19EE423F0D4E3509FD19D3831E586BBC8114DA48E368585510817C72AD2DF7EA3AA87FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069257, "uuid": "4fbf1fbf-89eb-4197-8bb3-546b2f7c9213", "value": "12288:m1IiYWSVnzwpPy1cBrEvEkJCJCKWiwadOYpEkV/9AaxhHf5SD2fmJ5ri4shlt:m+zWIkK1CkEkJ0tBrdXEkZ9Aa7HfZmUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069257, "uuid": "48e2982e-be44-4c9e-91ca-1ab3c25711e8", "value": 697714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069257, "uuid": "1cb3ee79-00d3-4c47-aad6-b37e11630668", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069257, "uuid": "62d9e94d-3d74-4bc5-9407-87b5deb44180", "value": "RFQ101#.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1248d0a-4d7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694091273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091273, "uuid": "b41f5fcd-c9bb-45d7-b200-2861cc3bf9b9", "comment": "Malware payload (njrat)", "value": "894d9eafcc490c991f29b758b9682953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091273, "uuid": "8aefb8fe-23b0-4098-b8ec-bb413db08e5a", "comment": "Malware payload (njrat)", "value": "a8d37dc644d751dd08da569ed355b9ec35b6ee6b523df819f3e1b4c7d4e63a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091273, "uuid": "fea46f25-8c01-47c9-a70a-c2ce3121c03d", "comment": "Malware payload (njrat)", "value": "99682cd2f5cc5d50b0c4a0f08f48635271951c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091273, "uuid": "bf89f641-f4c6-4203-a16f-e87a33cd6479", "comment": "Malware payload (njrat)", "value": "9a64c9b03f906badad1021430d9a7ca7649617d1e151735ff6f18cf058722606f0cca361c54b47a0c19e3a495c48e129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091273, "uuid": "03c9679f-f274-45db-b3a5-72f8a8f3868f", "value": "T1DD032A4D7FE18168C5FD067B05B2D41207BAE14B6E23D90E8EF564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091273, "uuid": "a5b91f46-a413-46b2-8ea6-87cb9b16016f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091273, "uuid": "ec4d4609-67e8-4618-93c0-1ee818a86011", "value": "384:y1KvEiTbnvpWNcZ0y8fbCzvvLoLkCQVXrAF+rMRTyN/0L+EcoinblneHQM3epzX2:cK3TZ38fbCzv8FQFrM+rMRa8Nuebt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694091273, "uuid": "44740ddf-322c-44e8-b7a7-5dbb66c3c4d8", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694091273, "uuid": "35f04756-26df-4859-9817-bd58862d8e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091273, "uuid": "c16a1b7d-28e6-4075-8ec1-d6d308e337d3", "value": "a8d37dc644d751dd08da569ed355b9ec35b6ee6b523df819f3e1b4c7d4e63a30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4611d9b9-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102690, "uuid": "4db3d5e8-b9f4-44c3-a88f-fac1f957ba0a", "comment": "Malware payload (Mirai)", "value": "5d0b5f19f57221577922b762b8a24d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102690, "uuid": "a6ec4bba-4a41-4ca8-b3d1-d3cbb3f19c2c", "comment": "Malware payload (Mirai)", "value": "a9370f0b3a71fdc2195efc58afccc5cd00baf2b6e42edd8014184aa472926b13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102690, "uuid": "33a7a35e-72a9-46e0-947a-f18763ea0a20", "comment": "Malware payload (Mirai)", "value": "52d83871586f5a9613d8bf6e80f1a3e069f97fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102690, "uuid": "5398e263-c806-4725-aff7-ab60741df096", "comment": "Malware payload (Mirai)", "value": "e956845e273eae6a75c69ae44c25ab16eefc96cfc7b161850ee7fcff192b518a6dd91cca3e85b48a7dbb7231a294ce76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102690, "uuid": "76eb607d-612a-4c5c-8bab-fde1a559582e", "value": "T14AE30A45FC909F26C6D6267BFB4E438D772A1768D3EE7203D9255F20378A85B0E36242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102690, "uuid": "ac50c62d-c0e0-4640-9cf3-d969a98cd713", "value": "1536:TkgglfWpOdC5dJQxv9g++I7XIgONEmPFxp1ADebtTqfEe/fUOTryHsT9OAlxGwyI:EfxdAmcNvF1A6tQEibYsJ5biid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102690, "uuid": "85bce121-f3ae-44a3-b653-30052997a2d1", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102690, "uuid": "480eb114-3b9c-47f6-a55c-fac5b77c7155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102690, "uuid": "176933c3-ab9d-4949-bec0-41e4b9255a67", "value": "5d0b5f19f57221577922b762b8a24d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabf7c61-4d97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694102483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102483, "uuid": "af9289ae-25eb-448b-8cb1-d25a62ef6a8d", "comment": "Malware payload (AveMariaRAT)", "value": "2bf10526c5c623167810832f6b0bca6c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102483, "uuid": "0f7de5d9-8fe9-4b2e-942d-66a05cefc0cd", "comment": "Malware payload (AveMariaRAT)", "value": "a94b8bb36703ea288bae378d8db74f114a3aebf4d04c96ac7f5e561e8a4e5d60", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102483, "uuid": "c0927bf3-a638-4645-8c81-755fec28dc23", "comment": "Malware payload (AveMariaRAT)", "value": "d3fa33c3d86d0456a8117fe29ea700845d1f09b8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102483, "uuid": "2dd86f7f-dd7d-4c36-be8f-c0bc3d4d3f26", "comment": "Malware payload (AveMariaRAT)", "value": "9d5b67476e558496c5d975ef356361ba73749acdcfdbd27db2f2294148232aa41272a0eb017033c0de190cd12869a5ed", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102483, "uuid": "fa4d26b5-295c-47a7-b2fa-35ded25f1d56", "value": "T19B14F117F3C1C247E56A533106C3D68E7B69BE6AAE26831F7202371EB8B6331CD15256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102483, "uuid": "e0923e6b-fc85-4698-9af7-4a8a425f065b", "value": "3072:CAN+svPwMrFoXiURMf8yS/TSTIs6sCbMD3itIm0QqgxJi+C:D33JodRU8yS/dLsZDyp0QZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102483, "uuid": "6d477de9-75a3-48d1-b664-66211d4f2249", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102483, "uuid": "a82da29e-79da-4ed4-923a-357df47f120b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102483, "uuid": "f8c9cc5d-0f43-4333-a2bb-165423441a21", "value": "zapitvane.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3658cbd2-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Urelas)", "timestamp": 1694084624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084624, "uuid": "c30c4b6c-5fd7-42f3-88e2-27439278e587", "comment": "Malware payload (Urelas)", "value": "0a90f9dfcc7c858243896d7aefe1b085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084624, "uuid": "694f6fed-d47f-4768-af07-a3d1cfb46766", "comment": "Malware payload (Urelas)", "value": "aa1ae5d7a1090bf621c74182d0dbe08ff45531addc63104e5630f470a535111c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084624, "uuid": "34eb56f7-f5ef-4e71-8974-9e914e0f4fcd", "comment": "Malware payload (Urelas)", "value": "ed85eff032170567cf217454a971ee01a0db78a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084624, "uuid": "a4781c55-cbaf-4904-85fe-6f4c0c4fb01d", "comment": "Malware payload (Urelas)", "value": "cc60f9d4c04eb35e93ef358d1882bbf7c8b05802bcb379d554149bbe9ea8a554d692fbb6822618ed574e8c35b199b1dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084624, "uuid": "08a5db1d-e543-4989-9a2c-d89d8a668682", "value": "T18694BF20B240C039F7A6073189A6E6F559696D3557A4E48FF3687D7A2E302C39A3335F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084624, "uuid": "46c95668-f25f-40ec-a699-4d4b2c2e3176", "value": "b6f1fd894a3d569b077fe0b3bff70868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084624, "uuid": "e402704b-a6a5-4e90-9c6e-dfc7fdae4f52", "value": "6144:xclgVrkccVxjfYNftqZe9+Hc0RLG0aOBAf70GbjUwMD9n/lR7e+XpMz:OeVoDVxjQ1gXHcuLHBS/MD9tR71i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084624, "uuid": "f659cb57-0d21-417d-b055-5936474f1ae6", "value": 420234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084624, "uuid": "aa681acd-fdfe-484d-b281-3925c9631c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084624, "uuid": "e6637373-05ac-4dda-baef-1ba5ee219305", "value": "Trojan.Autorun.ATA_virussign.com_0a90f9dfcc7c858243896d7aefe1b085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ce1109-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694079396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079396, "uuid": "c4ba0e2a-54c2-4c74-bbef-b7b02820a6bb", "comment": "Malware payload (Amadey)", "value": "1b6a19692f42d03cc809db8a9683ce2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079396, "uuid": "b8db9b74-914a-45d0-901c-44b6fa3e0d68", "comment": "Malware payload (Amadey)", "value": "aa33d0a190522c62acf4ab8eddc0713eb7efe1aafdc0c4a882a24188da5f448f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079396, "uuid": "0632eb53-8ec9-4801-97ea-32e39c9eb5dc", "comment": "Malware payload (Amadey)", "value": "e75d3e8b1fafb5e9af5b3a91ba9983fe741a3330", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079396, "uuid": "615064d5-e164-4db4-a33a-ed5d087d0604", "comment": "Malware payload (Amadey)", "value": "f38dfb46b9dc22037be798ca5dcdde69e241fc95eac1aefacc4292a5b3f22c4b6fe4e28d0278c2e38ba219266f5217ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079396, "uuid": "bbde898a-515e-4799-a56e-57b0780c6102", "value": "T14824F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079396, "uuid": "a2b1a2a6-9409-47c1-abed-4239dbdca931", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079396, "uuid": "964f635c-d4c8-4c36-b7f9-da294272efb0", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079396, "uuid": "7dac5e0f-7508-431d-af3f-cbe47462c29a", "value": 225985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079396, "uuid": "d57397e1-4672-44fe-85ed-3805f70bdc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079396, "uuid": "44858111-f927-4712-89c0-e38d40b52cc0", "value": "1b6a19692f42d03cc809db8a9683ce2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcec249-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103696, "uuid": "d3929d93-4747-4ad5-b49e-ae175fd74970", "comment": "Malware payload", "value": "e22f5e9d621dba25951129d7caaee7cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103696, "uuid": "d648e842-aeac-496f-ab03-8f8a27036a53", "comment": "Malware payload", "value": "aa75e3b1b37ec1cc1e9f53d1d9c9a2e9b22bae4b44a49e911726ab9671c75ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103696, "uuid": "7b97d42f-1e24-40bd-b2f8-af2d2472dc4b", "comment": "Malware payload", "value": "acd33d106def76cc077a8fe3d3073ea1aeba2fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103696, "uuid": "1c82f2f8-c310-4d9b-8c8d-4ab9a0475df6", "comment": "Malware payload", "value": "174b81dcc275949262f3f7b21484ef983a014e3ed47762addf91973134f9a9022e7bf53cca1dd394cd035e8311bec670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103696, "uuid": "a3c578b3-5aa8-46be-9431-ab996e58f8e0", "value": "T1A816187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103696, "uuid": "91b9a2c4-31e2-4dfc-ba2e-b7224efb0bab", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103696, "uuid": "c41bd94e-fb30-4e6c-8264-cdb685f573a8", "value": "49152:Jgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcW4jXNO:1a71fcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103696, "uuid": "c394d11e-2df7-477e-9fe6-b2f4b35f7454", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103696, "uuid": "cf69a7bd-d8ff-464e-af2f-ac7be817bc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103696, "uuid": "3521ba26-d6da-4ef6-bc9c-38cac9408752", "value": "e22f5e9d621dba25951129d7caaee7cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadeb048-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075505, "uuid": "27ab79ab-a76c-4b90-b05d-9631d104d46a", "comment": "Malware payload (ConnectWise)", "value": "03b03478c7277a26e23f97c89cea6042", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075505, "uuid": "b524f20d-f400-40b1-ba32-7d35762b1a11", "comment": "Malware payload (ConnectWise)", "value": "aaf858f4ba04e7e78489f8788e936aa81f647341fc1c571abdf03002bccf6500", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075505, "uuid": "438363aa-e67a-4bf3-863f-5a74cf12add5", "comment": "Malware payload (ConnectWise)", "value": "19e21387e49bdd7b85dfe05ee742082ca1e692f7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075505, "uuid": "5ed9c3aa-ba87-4982-b128-3f5b3bf471f7", "comment": "Malware payload (ConnectWise)", "value": "93d6224cc28df6d5b8841c2db1e2577c2acea873fa43b4d0389d44386612168cf1d8bd39499bc2a20f80fd6a2144731a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075505, "uuid": "51d6f6d5-738e-48d3-ba75-019a9b0f2ddd", "value": "T177836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075505, "uuid": "143ae70d-2911-4d51-879f-9fb3ad53d1f6", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075505, "uuid": "614c7c58-af8b-49e0-b9da-1944db2311f2", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx31k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx31k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075505, "uuid": "93e1349a-3b55-47eb-b1c0-6b722779eabd", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075505, "uuid": "cae6d374-07f4-4312-90f4-b6e14fc01e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075505, "uuid": "e01b316a-7b3e-493a-9c9c-b55457bcdd34", "value": "03b03478c7277a26e23f97c89cea6042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00497f42-4dbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119323, "uuid": "aa8c1fc4-512e-4bde-a5f9-d9527ecca4e6", "comment": "Malware payload (Mirai)", "value": "5d55c03b56f04c327255eb26bdf9e969", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119323, "uuid": "450a2338-29c5-4246-ac17-809bd5eb6709", "comment": "Malware payload (Mirai)", "value": "ab0c84568af5c3280c8e813dbe65975b618e6e1ff38d7d7b36476cfd715e2220", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119323, "uuid": "235e1f12-5796-4ef2-9414-110f248e56ca", "comment": "Malware payload (Mirai)", "value": "5972185611b1b21084d8dbf5139637c09b68dbf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119323, "uuid": "aa726165-6199-4830-9cd1-aadf9b46848c", "comment": "Malware payload (Mirai)", "value": "5d82fc2533c25917171089cf785612214e85913de5e094785b86be8c1c5482a95065a5cdfe5322f75a795ae6af8e1204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119323, "uuid": "d9b93c94-5ed0-4791-9534-e884283d88a3", "value": "T146230271840E9EB124703C72EED5D793BAE12AB1C6673013D9290A382FB57531E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119323, "uuid": "37a71723-f335-4970-a6f4-2e776615d750", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3s3/9q3UELbUXfi6nVMQHI4vcGpvF:gECFd+A6YHAxjLRQZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119323, "uuid": "b2079cfd-a2b9-4fda-b8a0-96a18c60c123", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119323, "uuid": "32aeb638-1baf-4a63-89be-542b81d4bf1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119323, "uuid": "6fef21a7-ad36-4939-8f94-8fd5a20ca428", "value": "5d55c03b56f04c327255eb26bdf9e969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec00faf-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067861, "uuid": "a3593d12-bc03-4741-b005-dbdc20edf82f", "comment": "Malware payload (SnakeKeylogger)", "value": "c3f352c7c8fdb88fc7c5daa05196a5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067861, "uuid": "dcc8640f-a3c8-4915-a7f1-fc3cff97b372", "comment": "Malware payload (SnakeKeylogger)", "value": "abbb76856376be2eab8d979b5bc988d1f19413beff908081d0a905cf5a271786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067861, "uuid": "3bff9b43-dafa-4586-bb88-4f84285841ce", "comment": "Malware payload (SnakeKeylogger)", "value": "5c5549baf9384c52c15458772b36afb779b99d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067861, "uuid": "bdce20ce-e113-44d1-baee-8ec93f7a64b1", "comment": "Malware payload (SnakeKeylogger)", "value": "144ba5236af2d62b818a1ebe8b887d038ce04e721d9b78bbdb4024cc14ae4ca0c0c6f8cdbb8916e4e9fc755bdaca498f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067861, "uuid": "c7a90edd-aa8a-487f-85d8-fb380145cc9e", "value": "T181B412229D520F7DCC7D23F2C530315207BED52A602AE72D9E9A21C4477771D0AA2B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067861, "uuid": "8f307787-d2e8-41c4-9888-278460c625ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067861, "uuid": "c75125d8-93ea-4a89-9165-6917003cdbf4", "value": "12288:zXQ+govVy8JqVSOj65cjMT0INZkQ+UBRvJ4RLxvW32ImGf5fVsbRf8:zXQ3otyY0SO2djNZp+UBRj3lftOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067861, "uuid": "f11fb265-42c9-4fd4-82c4-e2ea0effcc89", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067861, "uuid": "beb7e4db-22ee-495e-88b8-ab34a706ef08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067861, "uuid": "d4f9b1c2-bfa9-4603-888b-4fd55e0439ab", "value": "doc 2023270899001900110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebfe928-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085148, "uuid": "3d2089d0-7567-4e64-b86c-080e045f487f", "comment": "Malware payload", "value": "a93272d2b8bef5099aa128835499b000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085148, "uuid": "975643e6-ed88-4995-ae9b-3e5976ee3ffc", "comment": "Malware payload", "value": "ac491d5c60bf4f709e570a4c29b720937d8045ee994f4c7fcee20f6aaddd8df2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085148, "uuid": "41d12f93-cfbf-4345-a1de-5456bbf4eb84", "comment": "Malware payload", "value": "96a3eac00493da5a34388864ee7f6d573fcf3e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085148, "uuid": "32f628f0-01f9-475d-9955-278ab496dfe0", "comment": "Malware payload", "value": "7ebac38421ae4cf54d699b0b9eb7b240050f7d3d955917ef1ab0fc939000359e6e7d3a62993812171bf8c15757b3ebc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085148, "uuid": "0281120c-c5c3-48b8-8580-ae615d35aefb", "value": "T143747C11F380C036E4A141B989B7CB716A6DBE705B6862CB63D03E9E6E712D1BD3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085148, "uuid": "6d00f66c-641e-4a89-b205-aaf545c77155", "value": "2cf2a9e0f8c6a675c5f2e30fd0e214f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085148, "uuid": "6bf9700a-99b7-404a-b146-118eb35dcbae", "value": "3072:aVHgCc4xGvbwcU9KQ2BBAHmaPxiVojb5ERW77N0EvguCEFev5fD4uHDFSTtCt:rCc4xGxWKQ2Bonx8E4MgxDITkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085148, "uuid": "4c242fb4-4a6d-4495-b482-41c7728c6c65", "value": 364247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085148, "uuid": "14e60488-3e2f-4e00-a25e-f105dab97cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085148, "uuid": "d35a7e26-c32e-41dc-8232-c0eafdb867ea", "value": "Trojan.Hooker.ATA_virussign.com_a93272d2b8bef5099aa128835499b000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cd707f-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694090885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090885, "uuid": "3ff60f22-9daf-4afb-9136-352ba8c948f5", "comment": "Malware payload (RedLineStealer)", "value": "38c3210bf090888cb735e1fc36ee9c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090885, "uuid": "6e70f813-df00-4812-80bd-25300f472095", "comment": "Malware payload (RedLineStealer)", "value": "ac660e725f1484dfe6b6d4f8606a4711fd9354c2bf8d5d4f63bad03c39849894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090885, "uuid": "6915b118-d3c5-469a-9159-9a27895abd2b", "comment": "Malware payload (RedLineStealer)", "value": "a4893c01aaacf84dbc7c550eb05d576edc3c227c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090885, "uuid": "4c83cecd-4c96-45a1-b8e1-c9a84f88dafb", "comment": "Malware payload (RedLineStealer)", "value": "37d41abd4bb1a5e696ad30cec477caf709a586aa68f831f194e8ccc02c71cf731c4f27d8a46e5360664ca4f53e5f9fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090885, "uuid": "29dd6d7d-4c48-4219-abc9-ed6b743ea592", "value": "T108B55C20388171A3EDF310B786EDB46A526DE0B4B72735DF15CF0AEE8A907D13A35256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090885, "uuid": "8b610155-3740-4882-9ca6-593f4c8b49ad", "value": "4830078074f8b890bae0c9712c9b8a71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090885, "uuid": "82368e7d-fff7-4585-808b-c90896df2f1b", "value": "24576:FrIEs9ZB9cgZTgIZdkAimbngY8ccNp6g:xcB9cgZTgodkUgAHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090885, "uuid": "f2533c19-b464-4400-88a6-835549bec4f8", "value": 2315264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090885, "uuid": "4f63c101-d707-498e-aee7-86faa43c0818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090885, "uuid": "66250d62-e29f-44b8-a175-b524edacde07", "value": "ac660e725f1484dfe6b6d4f8606a4711fd9354c2bf8d5d4f63bad03c39849894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646d8bec-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075682, "uuid": "a8c92d7d-e5b5-4f34-a51a-6b32e3dd97aa", "comment": "Malware payload (ConnectWise)", "value": "8087e961ae5c3465a3b6d4d6ea3963cf", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075682, "uuid": "c3d83cdc-1460-448d-b875-99c6b0cd226c", "comment": "Malware payload (ConnectWise)", "value": "ad4fa0213acb59cb44dcc66f30a3ddde8a542aacea5aeb5616f7822c73a9712d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075682, "uuid": "f41ed79b-c146-4a14-98d0-7296f375c8de", "comment": "Malware payload (ConnectWise)", "value": "80a0e6c3abbf353692f1b6f83c318a1f3954eea3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075682, "uuid": "d22f351a-fb0b-487e-97aa-c47f280c10d2", "comment": "Malware payload (ConnectWise)", "value": "43eec363dd30426e2b1272bb02b0f5e928175d465413645873860041d71cfbcfbe8b34b67237f5340dd3283e3c7f2f4e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075682, "uuid": "8c0a3940-846c-4616-b2ee-ab5ba8a84617", "value": "T1B3835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075682, "uuid": "673facc9-b291-47ec-8640-150b4d5c667a", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075682, "uuid": "de835249-329e-4741-aa2f-3ff289bebc8b", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx33k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx33k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075682, "uuid": "e5405eef-b2ab-4b28-bcfd-61b1df096240", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075682, "uuid": "51f3e794-1218-4e88-a185-f57a8c2d1b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075682, "uuid": "1efe4256-f0cd-4f58-8bcd-3feee036ed51", "value": "8087e961ae5c3465a3b6d4d6ea3963cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543f006b-4d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694089399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089399, "uuid": "fc53ce6a-ad1a-48a7-adb5-2497ebb1cf6a", "comment": "Malware payload (DCRat)", "value": "0aa23e6d6b0d4102cd1db3abcbb69a04", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089399, "uuid": "7947f386-fde8-4826-b9f2-edc82dcd9ada", "comment": "Malware payload (DCRat)", "value": "ad8000475cae8b403f48a5aaab06ede130ba3717c30abe2377d99c1866d9d64e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089399, "uuid": "89bb4a97-9f3d-41e0-934e-74b688d276ea", "comment": "Malware payload (DCRat)", "value": "3f5992a1c8bd20372037ef67efb98db245cad600", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089399, "uuid": "9c2260e6-ecaa-4369-8942-c97812a0957a", "comment": "Malware payload (DCRat)", "value": "c34c3fa6ce5044f08a6053809ccebf9ac2eb5f5de322625c2ecf666590a7eb070403de5dc85d0af975aef912826757e3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089399, "uuid": "3fb71513-d921-473e-bb4d-63065dc7d3f1", "value": "T10D46C0117A01CE27D0290336C9AF536447F8781126BAE3477BAD36AD6EB33967C583C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089399, "uuid": "822b984e-af4e-4167-83da-ff7efc0cb60d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089399, "uuid": "797db866-2d6a-4153-881f-d6589d675c23", "value": "98304:eb3IcoWpE8Q7XwZNKISDfzI5EPBFEt8yFf7:eb4mj2g8Uf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089399, "uuid": "42ba3633-296b-44da-a319-bd1f0dcbf140", "value": 5464064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089399, "uuid": "d5f3bce4-3ced-40a9-af2a-3b3f379fdbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089399, "uuid": "1aeb1e6a-35ff-43ea-808b-6be78261ce2f", "value": "ad8000475cae8b403f48a5aaab06ede130ba3717c30abe2377d99c1866d9d64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3961d1ec-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694096655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096655, "uuid": "bdd6fa3b-a9c8-4a8f-8028-45148571462e", "comment": "Malware payload (CoinMiner)", "value": "307cb41d8a71fd6e2efccf8745406f99", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096655, "uuid": "82cb0b27-376e-4158-9328-08c1576ec470", "comment": "Malware payload (CoinMiner)", "value": "ae68aa627df4a3fd10e5416195e29203ea60227560f3e1de22fb907e86c369ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096655, "uuid": "4dadb0ca-021e-4c14-b063-035c8af88a89", "comment": "Malware payload (CoinMiner)", "value": "92228ffdb59db6361bb052511a0224c4ad8d39d2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096655, "uuid": "93b9a0e6-7b73-4a41-b0ea-b592f1dea3e7", "comment": "Malware payload (CoinMiner)", "value": "f0385f33603944c36ec1dccb849b8e755e0d81c393b23558a89d4b473bc4b6df1c5e26c8a3f68d25884c57d153f7262d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096655, "uuid": "02c8617e-d62d-482b-b6ec-fbe734d978f7", "value": "T114C533D23DE8C5F1D191A17885D6996008F46E2D2F018CD77AE2E807BA707EAAD3435F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096655, "uuid": "7345580a-40dd-47bc-8d52-714ef37c3b65", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096655, "uuid": "fc9a72a5-f919-4ae6-b709-0ae3a1bba846", "value": "49152:EJ5TJcQmWsQqR+hpQctWUsM5m22z5QE+pHZezwo3CcIw2EF/UQga/:EJ5Tt9N0+hpftWUsMJ2zZiHZe8oowMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096655, "uuid": "0469e2ff-2901-44b7-beb5-076bd33fac09", "value": 2660472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096655, "uuid": "e1b14bc7-149b-4b4b-9155-d358acd6c4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096655, "uuid": "47a1da80-b67a-4378-aa80-f6c0c7193b83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0dfa4b-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075534, "uuid": "20d05875-d558-4f8a-a0fb-b0015ea41ce3", "comment": "Malware payload (ConnectWise)", "value": "7fa48101ec67555fb302bc6565d874e9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075534, "uuid": "8e0ff174-4ea8-40b3-841b-1cd091d31230", "comment": "Malware payload (ConnectWise)", "value": "aee78cdec9f42c0b334af4003a9ea896333d806c3a6de6f52a62930b5bfa4fa3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075534, "uuid": "0e2c4aad-cf95-4fd5-8131-934a1d6303e5", "comment": "Malware payload (ConnectWise)", "value": "1d63c262d30acc44961f450c5f020875ad04cd7f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075534, "uuid": "7896e101-f629-448c-95e6-0f8aa0a61869", "comment": "Malware payload (ConnectWise)", "value": "cdde8ef232f953081d58c11204af9d4f931a561297ab134b2759eb451ebe92e7bdd35e0ad3e01a2ac96d7adc8bf2d6ba", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075534, "uuid": "ba33bfb4-5261-421e-85c6-18d1d48aa2a0", "value": "T11D835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075534, "uuid": "55d21e33-bdd7-47d6-a15e-4b9742dd3ec6", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075534, "uuid": "5f33340c-c081-41cc-a525-cec574954241", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3uk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075534, "uuid": "c0f9ac29-c192-4dfc-b2c4-606658eb2afe", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075534, "uuid": "609f2e62-ea8e-4b6e-aeef-1a2e541137d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075534, "uuid": "45db2f50-abf7-44d4-87e0-41ee1b9cd802", "value": "7fa48101ec67555fb302bc6565d874e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77dbe02-4d1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694049676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049676, "uuid": "61a16fbd-4b26-4b87-9d98-8e9f512ef695", "comment": "Malware payload (RedLineStealer)", "value": "f1406d200d1661f926b63b67fac05e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049676, "uuid": "1d296e42-de13-4762-a933-e765fb0511f2", "comment": "Malware payload (RedLineStealer)", "value": "aee9fecb361722aa3347227916a7d3d3ef8d0bac1b558e79327cd4453f54d8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049676, "uuid": "852a37e1-eb82-4460-935e-9eea4ed03011", "comment": "Malware payload (RedLineStealer)", "value": "1c84dd5c3555f1a8cb9bbc8f7708efc46f89b7ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049676, "uuid": "056093c3-88ff-473b-b90d-363660465219", "comment": "Malware payload (RedLineStealer)", "value": "c0be36ed82ae89d0d1b1dd0088e7b58b2ec8db5058e27ded0466925589b58f76337c3d412b02a37013e2c08ddf5277f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049676, "uuid": "89c01505-6829-480a-8efd-c36a8a16c2ae", "value": "T110E41217DBE84033D8B8177058F242931D367C52ACB8821F3789A91B1C726E99E757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049676, "uuid": "29ad1b6d-3e03-4de7-8214-b2528a32d285", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049676, "uuid": "5e4ba58a-bfc2-4d39-9d49-f74b4712d1ac", "value": "12288:9Mrzy90Ts2OJ+AgdTDOjqUwqBpvS4dT8Mm/MG8soezqn1f:SyAsp+AGY7lNiMG8WSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694049676, "uuid": "64294bef-03aa-45ed-a906-89fe8ff7cd9b", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694049676, "uuid": "1f9e37f0-6efb-4dfc-8de6-897c368f9927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049676, "uuid": "887f2492-ca23-45cb-975f-3a7e847d3c9e", "value": "f1406d200d1661f926b63b67fac05e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ac7e5d-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084949, "uuid": "ec4bd49f-8320-4fac-a3c2-e1fefba7bddc", "comment": "Malware payload", "value": "4321a97145d348977e73312a12c40fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084949, "uuid": "dafa103f-5edc-4185-b919-43edb7e7a9f7", "comment": "Malware payload", "value": "af0bcf13733f5e7e6bf2b4ea7630b3a286d12f4b350d01a4085c10994653b629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084949, "uuid": "c2030770-afe3-46e9-ac24-a724d6f04a04", "comment": "Malware payload", "value": "6622cd0810580d5a7e8dcf0b805f70f9f7c3425d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084949, "uuid": "2ec1c1a7-62f8-436d-a6fb-7ad863c8fb5b", "comment": "Malware payload", "value": "2ea16d4ecfbe8238fdcfb9e9a56d25fa2ab66bf072c04fe85036bcca55aee27acee7be09daa01fce95d0b71ba35fb775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084949, "uuid": "e7dbf3b2-dc5d-4267-bc30-8f33713e7a19", "value": "T1EC363A07F89180A9C1ADD230C666D293BA717C885B3423D32F50FBB92B76BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084949, "uuid": "9c1da8bd-4f89-4c80-a004-2b8e781b2620", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084949, "uuid": "9aa1a90b-7f5c-4fc8-9b11-31052d96df03", "value": "49152:lwcQ7633Q7/rb/THvO90d7HjmAFd4A64nsfJMxxb3jUuE4hNyY4/wa6Z3ff/7KaA:T3Q/xRzU0Nz9xEeDXuz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084949, "uuid": "7a02c8d9-ec7c-4f3a-8e8f-c77efe4078c8", "value": 5067274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084949, "uuid": "f706dac4-16ab-4da7-a8bd-1d71fb48697c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084949, "uuid": "b276fb6d-963b-4730-9bcc-8989c9369f96", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8f717d-4da6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694109007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109007, "uuid": "2fef4422-b6da-47d6-8a70-c96cc7ba2bc1", "comment": "Malware payload (Mirai)", "value": "21eb68804dd03c8253d19c9247acfc4d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109007, "uuid": "b28cf129-47ea-4e2a-86b8-182313894341", "comment": "Malware payload (Mirai)", "value": "af95ad53e1af8715068e75f1630060b277078894ffbe9caf371e3a229b528bf6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109007, "uuid": "03c702e5-9496-4c52-b63e-1316616c1764", "comment": "Malware payload (Mirai)", "value": "5254a68bebee6a7d8983fd55b595190cfa9b6789", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109007, "uuid": "5606f236-ad3a-44be-ab43-05ed361799a6", "comment": "Malware payload (Mirai)", "value": "8545868ab92a9926b92b0d1304084f4851f55ce41c82c7f3fbb659d417783c0c6270907a4f732814cd89737d92ff95c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109007, "uuid": "5db1113b-6b94-47c1-aa3b-6c95a27ce040", "value": "T165A2E11472632D55E3ED1C3DC96E8317F9A71BFC90F5327679456A20C90D24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109007, "uuid": "6fb9ca99-c994-442a-9367-f311cff3f07b", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjxImhymdGUop5hP:vvQn4j+ZO5fKAlxFjs3Uozh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109007, "uuid": "79356a86-33cd-430b-a211-7bb9ccbd1993", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109007, "uuid": "5730fb5c-51c7-4110-93a2-d3ab8c6fddb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109007, "uuid": "c228cd50-d918-4987-94d8-4dc84d78e18c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d942381-4da8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694109628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109628, "uuid": "0d9399bc-ea8b-4ab1-980c-b9c4aadd5dd4", "comment": "Malware payload (Loki)", "value": "83176ab35da6c52b0a1adc3ca6f1c7a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109628, "uuid": "65cc1f81-9320-47ae-a5d9-9a8636348dbb", "comment": "Malware payload (Loki)", "value": "afbee5b1736540ce33c53a98871fcaaf36c8600ff17b48996e1fbafebcfc904a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109628, "uuid": "ff04c19b-7857-4f57-ba94-f650b560a1be", "comment": "Malware payload (Loki)", "value": "64c41614cbc5408814590bacacdcee62ea24b66b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109628, "uuid": "0ee5c045-11a9-4f10-a484-cb879c58b1b9", "comment": "Malware payload (Loki)", "value": "9897afad99a705613893a7a5ccf42c1e94c219f03e824deb28d550c6c1467a15ca169fbdeb691da5aa82ecf97ce2a22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109628, "uuid": "ce7cbba3-7f85-4263-9ef4-cc38d0225733", "value": "T173F40151BBD284B2E57319351936A700AA7C7E742E30CB2EB7D47E2D8E31181A525FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109628, "uuid": "64a58480-42eb-4ec0-a93a-7d5b5f8df33d", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109628, "uuid": "fbb5fc59-1f01-4c4c-b05c-b64d8893e391", "value": "12288:NcrNS33L10QdrXj2Dn0emc/ZLg6GehXOdo/wn2rq11xUrxbRrj66/YOXjtD:wNA3R5drXCD0emc9g6GZdo/wn2S8l/zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109628, "uuid": "63ab4ccd-d387-4872-baa1-cadeb04b0957", "value": 744584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109628, "uuid": "b6652327-e0ef-4efe-8a6b-38ee5606b5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109628, "uuid": "2d1756ac-ef15-4503-b2ed-b1fe609326b1", "value": "Especificacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb32bba2-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QQPass)", "timestamp": 1694085277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085277, "uuid": "2335bc9a-d183-4dc5-a1ab-7047d8fffd93", "comment": "Malware payload (QQPass)", "value": "7a8af5229d113da5299dc3c605a17b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085277, "uuid": "053ff193-296f-4eea-951b-2073ed6bb8b2", "comment": "Malware payload (QQPass)", "value": "b0c2b7027cf546c5951476dad600c8047b634e8791c50d279cd6fa5c28a5ecb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085277, "uuid": "0da8ad26-64f8-4e52-bf34-98613e20a68b", "comment": "Malware payload (QQPass)", "value": "fe2e4591d33bb8c9c7690a99beb58a56f5911682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085277, "uuid": "165a66a5-4db8-49c7-aa7d-131f1beb4ebc", "comment": "Malware payload (QQPass)", "value": "272ea72c2cfd59bc0ad2dd68d22875b20b199fdec6a0a4cf5a0305e1009f06eaf0e7466a76d1d3c9688bbf6f6973fe02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085277, "uuid": "3324a6a9-5c10-49b3-83fa-7fc0b3cc117c", "value": "T1A434171AA20F0269F381C273250A5CC7EE195FE71AE5C590D47BA31D1A52F1B4EFE2B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085277, "uuid": "5f44cd2d-6420-412e-bacd-686db1c2f989", "value": "149c68dc98a2f671a10697b9eaa5faa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085277, "uuid": "7a1d6fbf-3296-4a5f-91f8-307fde62c555", "value": "3072:ydEUfKj8BYbDiC1ZTK7sxtLUIGT9kXH0hga4PjBy2XiXV/mwTwyg4K+mpPNHdUpW:yUSiZTK40V2a4PdyoeV/Hwz4zmpPNipW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085277, "uuid": "4d011caf-6cef-4de3-a4f1-bf75a8418547", "value": 233677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085277, "uuid": "7c12763c-528c-479a-8264-28588faf1a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085277, "uuid": "4952d57a-eb44-4d01-9be7-3e3eef5cc7f9", "value": "Trojan.Autorun.ATA_virussign.com_7a8af5229d113da5299dc3c605a17b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64917d63-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069240, "uuid": "fcb73432-a95a-4a43-9aee-ffe1bece59b5", "comment": "Malware payload (AgentTesla)", "value": "504dbd0f87196fdd0bfad07be39b3aa1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069240, "uuid": "d69afeef-e659-4d75-b2ac-cf6abae5e096", "comment": "Malware payload (AgentTesla)", "value": "b13d796797816cf7263e721d0b4545e3bc4596d1556817aa4b02bd0db5f544b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069240, "uuid": "b4eea04a-54fc-4bd3-bbea-40d7022baf1a", "comment": "Malware payload (AgentTesla)", "value": "d0506d921d5712fcc7cac3cb1f5ecdc9425adfef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069240, "uuid": "e08f4a9a-1897-490e-9fd6-29a23496acf5", "comment": "Malware payload (AgentTesla)", "value": "6cc2a417ed9cac98af905940b7d0e37773d11452ee5a37909dbb14e30af128bad0b9b7036bbbb95a76c956038a80cf30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069240, "uuid": "5345c64c-105a-4d7a-ae54-3d5d2cbe8a95", "value": "T1E7D423DAC4042E46A90D2377F722E8F7ACFCD5097A17A06A1E5C45025FF17E6C890BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069240, "uuid": "0191dc7c-adff-4129-90b0-95e001f1cc83", "value": "12288:AAh+c5zvluD1bu18T2/Bs7vScmLJW/ajNcED3zY4RzC96v9:AAhxZ61b9T2C7qPFW4Dc2mov9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069240, "uuid": "165935f4-d66e-4abc-80f5-21d8b771fdd6", "value": 608562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069240, "uuid": "e435ecb0-8391-4b41-b0a2-80a4ab23a035", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069240, "uuid": "d8a3c7b1-76fa-4d3f-ae0f-2fa1f7d39190", "value": "PURCHASE ORDER .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824f1668-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103220, "uuid": "0e4752f6-e3e9-4b3a-8898-4f45c02e0558", "comment": "Malware payload (AgentTesla)", "value": "0cd15695db9e6646481c03bb48230d02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103220, "uuid": "daa258d3-2950-4870-9cd9-d53b1e7946d4", "comment": "Malware payload (AgentTesla)", "value": "b1425cafd29d74ace4c4f772acea0b7e94142ec7dfb756696d9de99d0fce2fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103220, "uuid": "e436fd3e-efd0-4776-ab08-8afd6f54259e", "comment": "Malware payload (AgentTesla)", "value": "b295862db6cfde9eae6cbfd6fea253e714e0ce39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103220, "uuid": "5fdc9fb5-4c44-41fb-972a-7bc8e8cda40c", "comment": "Malware payload (AgentTesla)", "value": "86ea2fdce5a8d1c1014dd0247bcf82cc993793f9453d2d5860b889a35d7c8e940da06143ed77ec77d410477ec55110f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103220, "uuid": "8e3a020b-b108-490d-9f1e-548a658fd2dd", "value": "T158325A2990570C79D28F5BB6D00CEB146A663E43421679533FB0E9BC98671CB23EA35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103220, "uuid": "9f9963d9-181b-4182-97d4-1eda2b2edc4f", "value": "192:RBY0ylLG93q6wHjAXadt/NFuVtUnf1RV8j1pPHSucb:RBBylt8XC5NDRIPS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103220, "uuid": "a1848fa5-67a7-4e6b-901d-5e409f0efbea", "value": 11553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103220, "uuid": "242d69e8-da71-47d1-9d00-3d701644bb03", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103220, "uuid": "994fab23-b0c3-4148-abd3-91c6501939de", "value": "New Purchase Order.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd01d346-4d87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095588, "uuid": "5339cb13-7e7d-49d8-ae57-b02b76957a05", "comment": "Malware payload", "value": "37951007074476a3d49072ecbd3784b2", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordStealer", "colour": "#898BF0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095588, "uuid": "06b239a4-6c85-414a-aec9-bd44a0018a41", "comment": "Malware payload", "value": "b16529913d176e876aed153b0a5f2075f7cb32029e9c7d38bcd1ad254f2fe28e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordStealer", "colour": "#898BF0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095588, "uuid": "56ec47c2-c7f5-4ed0-b8d9-f1f49b62ef4e", "comment": "Malware payload", "value": "4c4b4a6994c6d26b66d7884de71b8a582f1788d8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordStealer", "colour": "#898BF0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095588, "uuid": "21be0f0e-5e83-4d80-9157-6a7a80407803", "comment": "Malware payload", "value": "6ea8f7e40cf4aca19ac36164d6212339f90725a57a2f96002d56ff4251bdca6e12dc43464367f44cbba5e355fdd9967f", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordStealer", "colour": "#898BF0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095588, "uuid": "2b52ac71-243a-4077-b78d-4193eb551b3e", "value": "T1A1321A10E1065863A772E7B5F93A944EFE22106B41016800F5CD86D9AFF47AD8BBCED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095588, "uuid": "c65a4363-91b2-4e8c-a3a3-a16ac2e9f5fb", "value": "192:VN/wPGVneVCcVnVTirbsl7qQdMXM9cYEJHyClInbQam/fz94gDJWP2D5tJ9bTmVT:VcJFcK7zdMXM9c5dIn0amdkPKNF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095588, "uuid": "ad166b56-734a-46ea-944b-9c375b0ec2f7", "value": 11594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095588, "uuid": "c89057c0-a458-432f-b7ed-2cb1ef48fe91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095588, "uuid": "603beb47-376b-45b2-960b-97ea998eb6c6", "value": "bYpCn0v8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff6ddf1-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694080292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080292, "uuid": "8df3a67d-e2d2-4200-a842-8a3eb0fe96dd", "comment": "Malware payload (Amadey)", "value": "83e7387cb7462a481df2418a264e2c74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080292, "uuid": "5ef8f9e4-faa9-4462-8b73-d5fceb06ee48", "comment": "Malware payload (Amadey)", "value": "b1ba71f8c7c9e46a301ed632e343f1cb58e34f664f051c6c3a940eb607d80ee9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080292, "uuid": "213a200b-801c-4d11-a3dd-365157d60f55", "comment": "Malware payload (Amadey)", "value": "0370e6dca61dc4a2b32ba1a8db2a546e5464a21c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080292, "uuid": "4586cbb8-5c88-4396-8a69-c4bba3a647af", "comment": "Malware payload (Amadey)", "value": "df2b183d1d52d4e377c455037af901d5df3f5f779b16c293d237e989bce2913073c313e9ac0cc7dd9fa0afb8c6930a1b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080292, "uuid": "400d8862-a32d-4539-85c6-1c853cd58db8", "value": "T1EA24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080292, "uuid": "f879a6d1-bafe-4113-a28f-ade5f25cd5f9", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080292, "uuid": "146d8354-1427-4f72-948a-6177afcb0920", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080292, "uuid": "599392cf-eb79-4736-8754-0d700ba5fd5c", "value": 226010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080292, "uuid": "8d61e90a-b14a-4d1c-a932-83917911510e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080292, "uuid": "98ccb324-821c-4908-89a2-f76b16c8ece6", "value": "83e7387cb7462a481df2418a264e2c74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d18a7e-4d81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694092752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092752, "uuid": "48deed3f-9372-46af-bcc5-11328807813b", "comment": "Malware payload (DarkCloud)", "value": "082b91713a94aba070148d2563ecb9a8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092752, "uuid": "feabe445-d113-4c1d-9983-f39dd2e48f07", "comment": "Malware payload (DarkCloud)", "value": "b2c04121abc661593e04224fac33300c7ae0cab408676a750bcaad138da4b96a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092752, "uuid": "eae9351d-ee66-4724-b914-e8e01737c8f1", "comment": "Malware payload (DarkCloud)", "value": "ccef8e5680dcd005d385d979f84b88674d3bde41", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092752, "uuid": "433cc242-c7f0-4856-bf46-571e3267d160", "comment": "Malware payload (DarkCloud)", "value": "ea3f57abce24ff30bde30ef451ac48262e5f4c92bb25c4b301be2edcf07fc756cef68d7fb3ddf9f1c3524c9a164883c8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092752, "uuid": "051f43eb-ce10-441e-b77c-4b45664a677d", "value": "T16DA42A1BE711A02EF192C5B0EAD452A768152EB72298EC57FB816F4832355D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092752, "uuid": "248291b7-b3ed-4096-aa71-36e5df8bdcc0", "value": "e1f594e59f684b51e1a504fb3c3b8636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092752, "uuid": "5b324217-801d-4719-8156-17f06d2737b7", "value": "12288:12tFZW4yzH9utcgyWDXZIuzLMAxU3hPsjYKkJj6GmZU:y2HOGuvMAWMYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092752, "uuid": "d0564668-8993-4d89-9652-660b239dcc11", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092752, "uuid": "008a9709-0cfe-47dc-a5dc-85ddecd7c141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092752, "uuid": "c08879c1-2a1e-4a26-90bd-ef00fd724134", "value": "b2c04121abc661593e04224fac33300c7ae0cab408676a750bcaad138da4b96a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1be1230-4dd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694126922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126922, "uuid": "336d8ef6-511e-4b77-b8ac-dc2338ed34b1", "comment": "Malware payload (RedLineStealer)", "value": "3b6af29aef5f64d58d46da7d4d2e992b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126922, "uuid": "d79b81a0-4d42-40fc-bbba-666960471e58", "comment": "Malware payload (RedLineStealer)", "value": "b2d733728672e3b8d101b3ceedbb92f207f34da19c7657f6704530962d5d2c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126922, "uuid": "c9c47e8c-314c-4569-bfba-dcfa338cec32", "comment": "Malware payload (RedLineStealer)", "value": "2beb92cf2a8bcca05dbd80a44f3addc29df9a3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126922, "uuid": "1ededc48-7006-4c8f-b153-4fc578021cb2", "comment": "Malware payload (RedLineStealer)", "value": "36e373f6fb9efd9d3b0e155113c50510397316299aaff61473721bf8443bb2a73fbb02a4482e9aace99cfc273af61efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126922, "uuid": "ea7d722f-4aa8-4f18-91d7-691b42976b55", "value": "T1CB646D23A2A1A871E52746398E6EC2F46B1EF8D14F5537EB2354EAEF0DB01E1C572311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126922, "uuid": "92afe924-2aa3-4487-8736-140099cc7091", "value": "badfd3002a7785754765042ffe6b2bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126922, "uuid": "e9b2e56b-d147-4c46-9353-d0c68d1f25b8", "value": "6144:KoO+bB5U/XI7QTtnk/Q7rIL7pdba9xUUTJ2y:NMPIUhnkYoHpVa9GUTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694126922, "uuid": "a444e6d4-f2f9-422d-a1f3-74d2149a6a0b", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694126922, "uuid": "20c5ffcd-1afa-49ec-bb52-8cbbec1a7ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126922, "uuid": "a9b8fd9a-049c-42ab-aaae-964dee9da70b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14a5b14-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694090441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090441, "uuid": "720c8903-33a0-4a13-882f-d472b4810126", "comment": "Malware payload", "value": "17753e6c8c0af53e80066383a4a1dde7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090441, "uuid": "969bb3dd-733a-40c7-b7fc-2d547373bfbf", "comment": "Malware payload", "value": "b361afbc0a867c7a038e8cbced855cb2a68441c905c9d2e97e76e6e85833f3a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090441, "uuid": "06c16070-975d-4c39-baef-fa555271889d", "comment": "Malware payload", "value": "3512d29f10d784c1c7294c115731ba9cee3d04e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090441, "uuid": "7edd9f8c-0a7c-4ac2-b3b6-1fd2d9aabb1a", "comment": "Malware payload", "value": "d9e5b0c3598a5ed5b9732fe50b6f2e90f437489d98259a068c26f1bffeaf804b8dfe43888f8ec12f9887af1590980d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090441, "uuid": "ee7dd908-b2ae-4192-8549-402169cce0c2", "value": "T1C7365C4BF9A204BDDCB9C934865EA133E625F8894113762B3BD45B102F26F209F5DBE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090441, "uuid": "4173fe38-eba5-497f-8cb9-ffd6ec7e3ecc", "value": "49152:CTCU4wxgy5176bfLlXo7n15CpXneRKiKM1nRk+1DQTDcpZ3QANtR8EUvtz5IU6iU:ECU4wxh2/WDZNDQT3QtR8ri+4I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090441, "uuid": "e8846903-7edd-4992-b05b-d456a26fcd29", "value": 4873872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090441, "uuid": "4d11cbbf-b97f-47cb-af64-ce4b8d3d1d6e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090441, "uuid": "61b66535-4f07-4b9c-b24d-47fddad662a9", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d63c77-4d97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694102468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102468, "uuid": "ea06a97f-ed59-446e-ba47-e599d44f2aef", "comment": "Malware payload (AveMariaRAT)", "value": "bd510e656df192f3d66e618420c28541", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102468, "uuid": "f64c85b6-7e3a-44c1-8578-f1d62855be2d", "comment": "Malware payload (AveMariaRAT)", "value": "b3c1d51c200dbbeea2ebeacdce3cb1b70fec80bdf8042f177cd152cbe595677a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102468, "uuid": "ce5c3e51-6d81-4143-9e59-818caf8b48dc", "comment": "Malware payload (AveMariaRAT)", "value": "3c182df9984f9636ff1e6f799e679542da72e648", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102468, "uuid": "b2b83f38-c7ff-46db-a474-59a7e287b0f8", "comment": "Malware payload (AveMariaRAT)", "value": "14ecc12136463db0593fb05ee0f4462f8d9d09aa269cdad92b5100165e9f04e40da49e81d2e777669334fa43f2dfacdb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102468, "uuid": "f34f0491-f200-4a0b-a54b-423e4b45d2f9", "value": "T13B140227B3A4C911F44183B498CBC5567B32FC64AE11AA8B67467F8FFD752709E0270A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102468, "uuid": "517e3359-f993-4360-8afc-8417b5938588", "value": "3072:TbiyWTxSoVHpNY6nemhInf/va46YP6z+d:fiyWTwoVHp6m0/yl6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102468, "uuid": "ec912a7f-25e5-4542-aa5c-4abb710b8006", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102468, "uuid": "ca61c9ed-fcce-4371-82c2-76cc2cbd2c0e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102468, "uuid": "e71428d1-44b8-4193-bf0f-592e47764a39", "value": "documento.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145c76c5-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694107760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107760, "uuid": "6e957412-26b1-4a01-89bd-57f9c8f566d9", "comment": "Malware payload (Mirai)", "value": "076308b3dd0fb8e593e76d3f3a4db5d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107760, "uuid": "c142352a-c558-4cdb-8ae1-39857943c633", "comment": "Malware payload (Mirai)", "value": "b42efa2f9dd78cdcac7da0deb81fdf58e7c91e6597c4e4ed17ca9372fcce67e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107760, "uuid": "68698784-ce25-4efc-b07a-5581f83c9441", "comment": "Malware payload (Mirai)", "value": "b900cc0f57d7a464fd76c7319afc95092085a96e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107760, "uuid": "c49829ec-2f06-4b7c-8b0c-586ce421e0ed", "comment": "Malware payload (Mirai)", "value": "109caaa0e5b5c57840e678f7403e1daf44c1b5a494c072360f869448dbc8222d7559f8bee5e54ec3ff09685e49f3423c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107760, "uuid": "b30b14ff-920e-4bab-8c01-602444afe3e2", "value": "T162831956BC819F01C5C912B6FE2E118E331317A8E3DEB2239D149B247BCB92B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107760, "uuid": "b4cd98c7-2580-48d2-a875-261d1a12434b", "value": "1536:ixn2UpvTjgu/+I7HCE9XZx6IRkGJPaTQEb9MhiW8o88wRww5yYk:apv371HtRhPaS8o88wRwwsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694107760, "uuid": "ea4f6dcd-9d51-4d71-b959-5724d462133e", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694107760, "uuid": "ecb285f6-3cc9-48f5-a155-f585c1264e00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107760, "uuid": "656090ed-eb3b-4c74-b306-482391fa43b5", "value": "076308b3dd0fb8e593e76d3f3a4db5d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0ca24b-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694069276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069276, "uuid": "3e46d3e1-6e2c-4bb0-a72d-f15678f0f99e", "comment": "Malware payload", "value": "c43f09befc18a6e16a09c5c9b6496d91", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069276, "uuid": "67407d73-21bf-45cb-aa4d-e10b47a21424", "comment": "Malware payload", "value": "b4903a782cd0f908ec3a0d7913dfe0703c15398abac4e8d07dfd45df54a13d17", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069276, "uuid": "4a4b2e5d-5f88-4734-a840-d27d52085ef6", "comment": "Malware payload", "value": "0ea2c654a7f43a45c4b157810984624e9e7f34d6", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069276, "uuid": "acc9e979-a4ca-4ca2-a045-640bdc2d3547", "comment": "Malware payload", "value": "3eda7f8da3844f64acc32e57535d01e8ac9aa852f2b4a75f31ed4acb87cfa540ab0046340ee23ab550e0797ba51ff8f2", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069276, "uuid": "696ca8ba-da74-478b-82f4-424b20b698d6", "value": "T136E12A3FB6A14839C35F3E3A906021415B287A6A934F1F06A530B79C1BA6AE70F5B204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069276, "uuid": "d7ce19d7-8c80-48a1-b0eb-44b3b992bef3", "value": "96:l6wYwy6FvY6106AYcTja6wMhVVCvkwQEeGIRf3UNaB6q2ZUn6srd6sL6fPXn76bA:/5qLUOV8vdQjmChPmXnUYuTztMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069276, "uuid": "cf19766d-0fed-43db-b350-34a2527896c7", "value": 7185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069276, "uuid": "f98bf926-6ed3-47a5-9cac-6fcfc9bf6ab4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069276, "uuid": "67d71197-cb41-4441-8cbd-6e7381be9137", "value": "PACKING LIST.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f049c960-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075487, "uuid": "3f6acfec-eb72-428f-893e-55dcc50db188", "comment": "Malware payload (ConnectWise)", "value": "1a6adb28c051417be246199b57375475", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075487, "uuid": "2e08222b-ad68-4927-9c56-d65bfe8df7a7", "comment": "Malware payload (ConnectWise)", "value": "b50a158ef88447dfc2681eed9ba24b4fee8c7a151cd749c1890d6589af3eb27c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075487, "uuid": "a88af116-f1d9-4431-b6df-c43dc98c8836", "comment": "Malware payload (ConnectWise)", "value": "33075ba17c670bb94a685eb98b9dfec0f2603b2f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075487, "uuid": "fecb7d0a-5d54-430a-9d96-72919d0a4c9b", "comment": "Malware payload (ConnectWise)", "value": "2f6d9574fb17a23240221cb7c4236c8cedbcaea77ca242f336c2c8aecfae1bac00c091915296f19dc7216910ea32a54f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075487, "uuid": "b201ea2c-c6cb-4f31-a913-50b1779ddd7f", "value": "T184836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075487, "uuid": "2d965a22-b257-43b5-8b7f-df3adb238166", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075487, "uuid": "ce4a3674-3d43-4a06-acd3-0b51e44fbf76", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx30k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx30k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075487, "uuid": "3a9b4572-1ed1-4f40-8acf-92308c9c1de0", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075487, "uuid": "a0a02e89-87b8-41a2-a327-c33160482f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075487, "uuid": "7dc680d6-8769-4667-8433-0771581b30af", "value": "1a6adb28c051417be246199b57375475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfa624a-4d81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694092848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092848, "uuid": "fa0b1947-ef08-4608-8f15-d7c2c81160c2", "comment": "Malware payload (Formbook)", "value": "be38afae7a44ad399898179daeb36d18", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092848, "uuid": "612476f3-26e8-47ae-98b0-37a941c5be30", "comment": "Malware payload (Formbook)", "value": "b53b918bda731bfd0bbfe94245c94acdc950660685c064b94a0c1174761d5d74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092848, "uuid": "003d8b6b-ca1e-4fe9-b251-b1b631afc0dc", "comment": "Malware payload (Formbook)", "value": "7cb6cd233477d665c053881e52dded9688c1c369", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092848, "uuid": "bf721483-1247-4e4d-84d3-715030b1c450", "comment": "Malware payload (Formbook)", "value": "843742c7f96cf3e9190e3c3ef584d1c6d05b72900eee5b1c1b81fbbbf82c8a033d83c31bdd04ebd19984f129cb40138e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092848, "uuid": "3ba4b244-3196-4e74-bb16-f05c59af0b49", "value": "T1D8554ADA5CC8BB82C71982B7EB02F8EC052BFE4D968524963471FB4A2D3355D1CF60A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092848, "uuid": "9047e2ff-c097-4cf1-a1b8-6056d3a75442", "value": "24576:FWQmmav30xSZyIw6Vz6NfFZyww6VW6N/il5ytQ8TA5Vf/ywdp:EQmmQ30646V+lw6Vno6tLT6fqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092848, "uuid": "3395b48f-5a36-4b08-b73e-be9e9d5cae22", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092848, "uuid": "99b4e1be-d1fd-4a1f-82d2-8b2434f8b17a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092848, "uuid": "2a61917e-1a10-4c04-9190-14f506432453", "value": "po# 348839.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fb35a3-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "7ce6ddb8-3a8c-48f8-956a-dd1438bf335b", "comment": "Malware payload (Mirai)", "value": "a054399fa1738b04219abca032085f89", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "92a753cb-49ec-4e1a-a087-b2f07207012c", "comment": "Malware payload (Mirai)", "value": "b5767ae80872be87c270031c6bc6c2bfdd345abafe73e8de98683645b388f643", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "6fca9040-73ba-46b9-8058-d2f4d1963545", "comment": "Malware payload (Mirai)", "value": "8eafcee6307aaa60d7f7c70d908fbf55310290af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "9ba01f29-479e-435b-a9d0-f2b6c629ef55", "comment": "Malware payload (Mirai)", "value": "f532bfb14005eeadd3b751992dd84e33815ecf073d7ec390d923a851a0346107adc7aacb1e5d36c7be788c90a8e9fa6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "377bdb76-b5bc-4f96-9cf8-3876a530c053", "value": "T1CCC2D130A6AD2CB6C6500571E77856C5BE424F7DEAFE3850124057FA7C829062DEA5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "4d004fd0-f519-4ade-98ff-53a17545ec2b", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEF59DdhymdGUop5hr:A7soTAZ3alkXLvFh8nNEF9s3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101807, "uuid": "e33da9ea-91da-4b37-a2a5-b499267b5657", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101807, "uuid": "c7fae2ac-1a64-41b9-9399-0879906d7af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "5b9c7295-8f72-48f6-8812-f6523571bec9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478daa48-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Urelas)", "timestamp": 1694084653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084653, "uuid": "be5f2990-d937-4d9e-b87e-c5ba343d895e", "comment": "Malware payload (Urelas)", "value": "0e08c15256d22508a9a40e6cde34746b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084653, "uuid": "49588500-6470-485f-903b-1781bb6f22f4", "comment": "Malware payload (Urelas)", "value": "b578dc7dd8d5ea8b28267965d6ca5e299964d92ae0d54e334527463390b3ad91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084653, "uuid": "f125a8da-42cf-47ab-9a0b-3f9a809874f2", "comment": "Malware payload (Urelas)", "value": "aad4b048d18c3a3b79626515c502886519bd7bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084653, "uuid": "b4417742-51cb-4caf-a7c6-0e9a9bce554e", "comment": "Malware payload (Urelas)", "value": "0e529e5cd48f6774901afdc7ba2fd01f74ba309a5d845fe9137e43ee2b366e3052e24142257ce52cc52f0db88348c7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084653, "uuid": "d163e12b-198f-4be8-90a9-57d6d76d436b", "value": "T19694AD11368080B5F76A0B704865E6B44A79AC3927A0E4CFF6B8FD7929312D3577728F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084653, "uuid": "3aaa62df-6523-4927-97a4-29d32084d3c4", "value": "ccb1fd1fca498ed2aa99d7e0f38d82b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084653, "uuid": "a86ca0cc-d770-4479-bebd-7cfac02901aa", "value": "6144:DKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fk5R:OANxU3VH1t19MsAlpXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084653, "uuid": "0fb7ba83-5760-4463-9b5e-4c6a465202bd", "value": 445704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084653, "uuid": "729474a9-b37d-42dd-b7c3-967bcb15a8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084653, "uuid": "99fe734a-6ea7-49d2-a49c-f0d18d5cc694", "value": "Trojan.Autorun.ATA_virussign.com_0e08c15256d22508a9a40e6cde34746b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d61d338-4d9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694105225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105225, "uuid": "65f9f27a-5770-4377-8d97-b12952894d2e", "comment": "Malware payload", "value": "13a4d3e321fda1a0bea7dbf7af7c0444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105225, "uuid": "ad4ce207-501d-4026-89e9-4b37aa1b6b36", "comment": "Malware payload", "value": "b5e047272a9b7d4f507496af4514c5fc600159c1868adb7317f4d2f70ef42873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105225, "uuid": "105c3f8e-e9dd-430e-b3b0-828eb7f21312", "comment": "Malware payload", "value": "f5850e06b2276733e84d729fff468e95a9f1541f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694105225, "uuid": "efe20e66-907e-41dd-bdf0-7a66bcbc7a35", "comment": "Malware payload", "value": "8f07c43cc7e8a4ee98fb484e6e061b4e189a6b63896b946eafadaf6658749bdac94c43b9dd0d6cc1ebcc6c3ebbb38ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105225, "uuid": "5141856c-ee5d-4290-be59-13da44e7d9c8", "value": "T1544419D476FB2EC3FB2577BC11E5F962147B3478970F9E939360D020862BB98664818B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105225, "uuid": "7375b30c-410e-4dcd-b5f2-1e703d96b685", "value": "b00287d2c72093fcba72474b9e3e3b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105225, "uuid": "2335b3a5-4918-4098-8c06-3198aae2a52c", "value": "3072:VTttzK/vvJmiH1AmcGvur26jgKYjXtRBJ4J9OSbxDTpe71sQinoZlvyYsK0y9Gr:V/KXRZ1LTpxt2TxxlnoZlKYXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694105225, "uuid": "2ea8593f-1c64-4589-9f14-d0675b71e974", "value": 265975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694105225, "uuid": "e08238f7-9148-42ad-83ca-63b89d2dee61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694105225, "uuid": "01a62c0f-924a-4c64-b71c-41a640e04e26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2ce4b3-4d65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694081035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081035, "uuid": "e9eae5ac-41ec-4ffe-9a91-1cd3cb75a512", "comment": "Malware payload (Mirai)", "value": "e94dce8f5d1f16c4e4687907b227edc2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081035, "uuid": "752e8810-6a04-449a-8d79-15b98a48ca17", "comment": "Malware payload (Mirai)", "value": "b62ea075cfc99980488bc206cba24ffcd4faccd8b1a80aec27d9d444c430095d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081035, "uuid": "e0ea7265-58de-4817-a332-49880c88724d", "comment": "Malware payload (Mirai)", "value": "68cfb563dc42e98242adf181f691481228741f58", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081035, "uuid": "7b39b533-f740-43cd-bc8b-3524852274ab", "comment": "Malware payload (Mirai)", "value": "19592299a44b43412dfe0c1e248f40c114ba58fe544d7d1e85a42fb188b0acebc5982494dbdc30b292da69afd5781215", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081035, "uuid": "4581aaec-8929-4a3a-a16d-28113a2c65e5", "value": "T1C4469E65B2A600E9D8BAC07CC61BAA17F7F1B4595370ABDB17B082790F137D15E3AB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081035, "uuid": "cc383d64-361d-408f-8341-4a4d3fdeae21", "value": "257db801bf29257f60ad247f0c5bf789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081035, "uuid": "55b12166-f504-40e5-a641-19bcb12b6638", "value": "98304:xLv92sOORvtIy0HYmGII4KlrgYJyzx9ydMt4IAJrxk3ovOqDDvZ:/2sFJyz7ydyAJrxk4d3vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081035, "uuid": "d6042a89-57a9-4671-ae37-6278e99ba35a", "value": 5641216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081035, "uuid": "e04628d9-97f7-46b8-95c6-fb2b3b1b48a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081035, "uuid": "15358c8b-9796-4def-aca6-d6d87d251f26", "value": "xmrig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911576c3-4db1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694113553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113553, "uuid": "b77bdb87-3b6a-4a90-ac2d-e8ea4b325bbe", "comment": "Malware payload (Mirai)", "value": "2483079baff4a131fea84332621053ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113553, "uuid": "dc97e3bc-3941-4d9d-98f6-1040adf0d419", "comment": "Malware payload (Mirai)", "value": "b692b18a09e2712b9236ebd2aefab474cc7821b2d3cc9fcbd6ec0c313b8e102d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113553, "uuid": "f65cbf2e-45dc-44be-8694-74c7dc82ef77", "comment": "Malware payload (Mirai)", "value": "83373df6fb13caaa92c1f24b98f5bd8b814ba746", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113553, "uuid": "039a5657-4a0c-461a-9b01-2e5a3e5c6d36", "comment": "Malware payload (Mirai)", "value": "866f397bea7040bd19fa5b96d334d7d385b9c9639ad2d4f3c0c9a3b6d3a44f1380a1d15475aa4b58c0792f782a66e499", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113553, "uuid": "a0f40797-73f4-4564-819a-5d7ba6735b91", "value": "T168F2F1E0A08CAC8EFADF99B55D5859D6FBA08F8539018CC425512F515F07233B16FB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113553, "uuid": "faa24702-8443-4de7-af88-7fd50a8eb744", "value": "768:KLn62rg1EWHclo6aQBxl/k0ZGYp3aorhWxbdOZr4uVcqgw0X7JkmWM:J+oB4dk8Baowx24u+qgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694113553, "uuid": "094b4e25-06a0-4aa2-a53e-1973f909c838", "value": 36700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694113553, "uuid": "df42da1d-c53c-47d3-af1f-052db6d49a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113553, "uuid": "fcc5ea23-906e-4a6a-811c-a9fc56422e2e", "value": "2483079baff4a131fea84332621053ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1181b22f-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694082845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082845, "uuid": "f49832cd-1224-4473-b769-9e3940d9a8fe", "comment": "Malware payload (Formbook)", "value": "6e4ed0a8b8018a1292e8d5e20978740e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082845, "uuid": "6db4fca6-1523-464b-8558-00d92df08f44", "comment": "Malware payload (Formbook)", "value": "b6d39a259d32a4bb7afe33ca2c6aa85c6ae0d2861be3dd0f77fab4508da5ce55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082845, "uuid": "ea1739a8-e5fd-4574-870f-54a540c9683b", "comment": "Malware payload (Formbook)", "value": "547cf0ab34b10a2ee2b31e40b99dd85de04ab0ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082845, "uuid": "1ee5ebeb-8960-4469-a3ac-42b86425b138", "comment": "Malware payload (Formbook)", "value": "d72c910a873a25b20a351bae5958742e18a9383f0898e06b394a66293bdf2e73bdf04c3c8e50908ec3a526ac35105120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082845, "uuid": "86b2639b-0435-4578-97f5-78756bc4916b", "value": "T12205EFC533D7902DE96AF5F312ACF80143663A376D51A8BF28981D3ECC21F1A4E5621E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082845, "uuid": "9528dbe4-40f4-4493-9506-63d2ac6f760a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082845, "uuid": "410f7c5c-f802-4f32-8058-cbd62bc7701f", "value": "12288:YAD8iAMllc6tWCFXY9fMg1KswZsvJJC1IrDBlAXJ9wzLQXSk/P6nja5hblL:fDVfqXsZUJA12PA5cKinj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082845, "uuid": "84876b75-a32d-4e93-9619-bde922e3e18e", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082845, "uuid": "b3b4fa38-9b1e-4f63-b640-958b713125ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082845, "uuid": "99e59cb6-b9c2-4763-8379-1444ec0e4fab", "value": "6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76e8d7f-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694084868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084868, "uuid": "3b27fda9-bab8-4b35-a55c-1d96aa856982", "comment": "Malware payload (NetSupport)", "value": "655d34a739d71fcbe88760a8c34a2099", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084868, "uuid": "1bddc229-ad24-46aa-9f85-ca6874b86d3b", "comment": "Malware payload (NetSupport)", "value": "b6d6745927be30ca12ba14142607f60cd5be98b7f6b124384cbc36dbcdf8c7de", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084868, "uuid": "92fe5b09-7109-4de6-915d-5ec8c48fad03", "comment": "Malware payload (NetSupport)", "value": "31e30bf05a51176710aa8ec5ff929a7a40a6bda5", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084868, "uuid": "413a92cc-98dc-49c3-9884-a09eed5f65bc", "comment": "Malware payload (NetSupport)", "value": "eca19c8351c52a004248e0f4b65296e65e41ceb947f77c33df4da7e535bb34979e29e46c7aaa9a1fa5a650dd10816e8b", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084868, "uuid": "bdf43d18-0f64-4b65-ada6-a2d2e21b4a28", "value": "T14A65AA342D79BC2847D7EE6336F00A550DE4466FE0303A3B1A8ED5668A7A2D115B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084868, "uuid": "b03d5993-6edf-45a8-a07b-3a79082687a1", "value": "6144:GNfFjOu+KfCPeivvreo+PNxhK5CEI1CxdU172nGysg:GXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084868, "uuid": "bea7aaf2-737f-4a38-9c7f-c8463a9c7d1f", "value": 1426540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084868, "uuid": "ea37f6af-710c-4e2a-ab70-c371f40e3e71", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084868, "uuid": "aaa4509e-983a-406f-aabf-cfb4ad476545", "value": "UPDATER(ver 116.0.1938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7957dadf-4d70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085596, "uuid": "3ba584cf-7b0e-42c6-b05e-c9058f7b6ebb", "comment": "Malware payload", "value": "d7383e0d32d1e1fee750425f525a42eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085596, "uuid": "0860194b-fea6-4a7b-a7c2-58e6e6cb74e0", "comment": "Malware payload", "value": "b750df82c49eaf47758fb618abc80b7d80dd3b73f0ebb079173ea043f0e4cad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085596, "uuid": "7a0a29e5-0990-46e1-a135-6d6fdd98d8ef", "comment": "Malware payload", "value": "e1c7befa7ab887a0f24eb709a1ea1ec1a1b39a71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085596, "uuid": "386113e7-5bf8-4c7b-8c3a-e2ed7b4cc361", "comment": "Malware payload", "value": "a8782e310ba3104d0b3fbe32bfed98b39a7626d1735baece5f68e4c17afd455a55731e75ac08911d0b88afd9d979359d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085596, "uuid": "72d082c3-4a55-40ba-ad9c-1d609043580d", "value": "T1F9A6334167C8D036D21A74F288A7CB686269BE61973556CBB3B438694F302C3FE7534E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085596, "uuid": "01c47850-4654-4ae7-be22-b70e62bb26ae", "value": "230363beee3a16b40f8fefab5ba42a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085596, "uuid": "13400636-301a-4015-a825-a0efd7867805", "value": "196608:6mY+NpirjHy/210fLkz9ny4mqOglWSv3Do86LY:Diz0f2LPHP886LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085596, "uuid": "4eb04de3-8986-4b17-ab31-b2b926da07f1", "value": 9695354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085596, "uuid": "7ef9dc26-1562-4576-af38-e0e14b38b11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085596, "uuid": "3db3e0c0-d12d-41a8-ace5-aa7988bbcebd", "value": "Bat vir\u00fcs olu\u015fturucu v1.6.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb38624-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694108041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108041, "uuid": "6535d445-d8e0-485e-a35a-7e17a18b71ef", "comment": "Malware payload (Mirai)", "value": "1a21ffe8b610de5207e79c45dc8b4d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108041, "uuid": "1b8b3b21-9676-40f1-906f-f456777164a9", "comment": "Malware payload (Mirai)", "value": "b8d84d0d38f1c06ae89c496476c910facc5683466ddc311d6766a6eb059d8e06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108041, "uuid": "97162d76-5df4-4293-8467-28e2ff3954cd", "comment": "Malware payload (Mirai)", "value": "e94dc5f59b5af22f015c8546b80eeb13abde8cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108041, "uuid": "5e39a3e4-6b0a-466f-b561-7aa8d5d921ef", "comment": "Malware payload (Mirai)", "value": "6385d10b8c132eb9f2e3b1e148e57952c2d769d9c70231a13f3384e58e1659bec69d228afa7490e2025c8fa2ca4999df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108041, "uuid": "c1c3e88c-6ced-4e43-bc6d-df26ab60fb2b", "value": "T1AC733A8AF400DEBCF40ADAF78167490BB531A3518A820F36672BFD977D720A54D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108041, "uuid": "d03a687a-9247-41ce-9049-e8507189f181", "value": "1536:fZ+MRBV+OeUQp6A2XcOfcERtXd8P2Lee4DSAiOKng9e31iL:fZKh2XcOfcwtXReDdiBhiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694108041, "uuid": "4145588f-9b27-4ea7-8af9-8a37b7cacbb9", "value": 73720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694108041, "uuid": "34c77816-a28d-4be5-966f-38ead8860f7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108041, "uuid": "223f8009-5550-4d5d-88d0-fe70b5c2a740", "value": "1a21ffe8b610de5207e79c45dc8b4d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b2c47c-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075528, "uuid": "ced462f0-2deb-4469-a35f-aed04cf392d9", "comment": "Malware payload (ConnectWise)", "value": "7ddffc29f3512d533380e9bd687cb9cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075528, "uuid": "4bf5ee6a-03a1-4f68-bbca-99ea0691e1a3", "comment": "Malware payload (ConnectWise)", "value": "b917b8f53b49f8edb4df05c8ca1830b53c9190e1e6b5fbb654aaa5289ecf8e2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075528, "uuid": "8cbc1af6-a81b-47dd-91f2-a2c22a950178", "comment": "Malware payload (ConnectWise)", "value": "49d570b8c63c23a1328580b2e4d05dfb23f301fc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075528, "uuid": "e76a9488-c7db-489f-a96f-42e9fc6a5721", "comment": "Malware payload (ConnectWise)", "value": "7b3dd598dc9792d754747074d7d42bcddd2884702e47abb6e6a41d793729b671e6efa927827dd16457574bf16b9706e7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075528, "uuid": "cb033faf-3a46-4f8c-bbef-36d87924e209", "value": "T1B3836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075528, "uuid": "d089bbc4-8ca0-44bb-9f29-f8e699daed87", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075528, "uuid": "b9f43479-03a0-4c3b-bfda-d205a4c5e66c", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Dk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075528, "uuid": "bf454344-434a-47fa-affb-67ac7d803402", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075528, "uuid": "31bc6da2-b465-4392-aa7d-8eff685d3b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075528, "uuid": "855766ce-fb3b-4c68-8207-d059f3b55e7c", "value": "7ddffc29f3512d533380e9bd687cb9cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab65272-4da6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694109006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109006, "uuid": "4bc94a42-abfe-4313-9dc5-6c5a64d2408c", "comment": "Malware payload (Mirai)", "value": "900cece74cad872c1de033ac2758ee7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109006, "uuid": "c40434f1-3401-4e06-b317-5d0c2d99d92e", "comment": "Malware payload (Mirai)", "value": "b95419b278dd3a0f60db905abc773f77979baef102018f73cad947ac66aec6b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109006, "uuid": "53f0a97a-9b0e-491c-9ce2-e133c7cde807", "comment": "Malware payload (Mirai)", "value": "df735ebd443e8ad4d57dcf3f9935cc30f263c54e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109006, "uuid": "7e1098fc-5978-4fe3-bedf-3cef75bd8bea", "comment": "Malware payload (Mirai)", "value": "7f36c0edff886fd9514c5427ab363a81dacca9b9201a4a6272a0613f4a3eb0bab60c0aa59677c76fdd74deb813f44fce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109006, "uuid": "0ab4501d-8d3c-4bb3-86ae-9359a345441e", "value": "T190230271890E8EB224703C72EA95D79376E129B1C7673113D6290E382F79B131E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109006, "uuid": "3916f796-cf6e-4e4a-a471-79479eaecad3", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3j79q3UELbUXfi6nVMQHI4vcGpvv:DECFd+A6YHAxWLRQZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109006, "uuid": "baa247d3-93c9-437c-b77c-fd132fc47a79", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109006, "uuid": "02a63bab-8802-4892-8d6d-6a36b39dbc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109006, "uuid": "8ded84f2-2fbc-43b5-a951-55d36b02af2d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab43220-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092282, "uuid": "ca85fa14-1ff8-4155-a9d5-06dc4b0f06fd", "comment": "Malware payload (AgentTesla)", "value": "ea4f304423a04b0bcffd2ec6821b98ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092282, "uuid": "cc0596c2-a05d-423e-b3b2-ab057e1c1396", "comment": "Malware payload (AgentTesla)", "value": "b9c74c6cf3df328ddeee396c2602a7d93a6fa4f8fc3f1e67e41d91e290592e4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092282, "uuid": "52db8e94-3e31-437f-9b4d-e13f7a789837", "comment": "Malware payload (AgentTesla)", "value": "c9addc47045fc33aab10b9ac422926623c146de5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092282, "uuid": "3dc3f04e-1dca-46bf-a198-83570dc7ce27", "comment": "Malware payload (AgentTesla)", "value": "3f4ab3730d7e21b97d54be294956aa2de8aed21028bd03c79077c8b6f271f6e50e86da12fb31e8850dab0c54f52e4f2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092282, "uuid": "014f07c4-e24c-4166-b35f-67aae8fe1303", "value": "T1A3E4CEF83161E3DFC76687BF99575C7099137C65123A828A727F32984D8DAC78E018B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092282, "uuid": "21aa59d8-d77c-4908-b05e-256f10f31fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092282, "uuid": "e1febd79-9cd2-43fa-b492-9c9ed037d3d2", "value": "12288:oq9Uq65fVsbR2ed1IqRA3bLaT3S6mXl/Bw9b0+33csOzm+bpUxQRd6n3bIOV5P3K:oZq6tO2edNRAPkCxlC9b0+HcSO2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092282, "uuid": "90b5b65b-aefe-49ed-a22f-b43452d876d9", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092282, "uuid": "faafdf31-62a6-4550-8c0b-bed1398b3959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092282, "uuid": "a3e0f6a3-0331-4903-8445-abcc7faa4bae", "value": "Quotation.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c46031-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069222, "uuid": "4ecedd56-fddc-46fb-905a-608e9a94a06e", "comment": "Malware payload (AgentTesla)", "value": "4bfae4c92f11a4e4283f271040bb970d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069222, "uuid": "49539ba4-3d0c-4f06-92af-56c525794a40", "comment": "Malware payload (AgentTesla)", "value": "ba362fc437aedb4deab3cc12007232cf144248c445e85708887b16a8828e44a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069222, "uuid": "10bb3d5f-cc71-4137-ad8e-4c95ba27a0dd", "comment": "Malware payload (AgentTesla)", "value": "0d3cd7d31564b3ec494c633a62bb9db8465fd99f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069222, "uuid": "92f143c0-e5af-4720-a792-bc5a7e442f02", "comment": "Malware payload (AgentTesla)", "value": "5c7486caa5520b9eb2d9ecf4ec5a784042d611349e159fef325be7e63510d191e812394449b90572dd4e4288ff87f337", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069222, "uuid": "442bc181-11f9-4443-8c1d-765dfd34e485", "value": "T16294221135EFA148B2E23F5757DD74EF8F6BBAA22B22509E304403878A52E94CF51772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069222, "uuid": "18130492-3d07-4208-bdae-a547d33891b8", "value": "1536:LDiiiiQDiiiiQDiiiiQDiiiiX3b32p7CDiiiiQDiiiiQDiiiiQDiiiiQDiiiiQDK:Gzw7pamCoG0gdVOWNQzN8IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069222, "uuid": "267d0151-5eb5-4be0-b95d-d24d3a83f81c", "value": 430702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069222, "uuid": "e274967d-1799-4511-a717-8b1157c564f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069222, "uuid": "e9e9d658-bbc0-4967-8fc1-b69819ec1a80", "value": "comprobante.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc30d3fe-4d60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694078836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078836, "uuid": "e17155bf-ec82-4add-ae02-fcbefa42edfa", "comment": "Malware payload (Stealc)", "value": "9a2285586984651e14965cf583f905a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078836, "uuid": "f0653467-1dc5-4684-b521-b3b0e2573928", "comment": "Malware payload (Stealc)", "value": "ba4bcbdb679b739a34ce15523d1daa5cc41245633de78523b98cf994c073c173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078836, "uuid": "38b05cae-1978-4719-9a48-491ce17a82f3", "comment": "Malware payload (Stealc)", "value": "391087da1218823ce40f2a1c1b39004874c93ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694078836, "uuid": "0bc265ce-c240-44b6-a639-ccf174ee5200", "comment": "Malware payload (Stealc)", "value": "1aa8bdbf7ecdbb7f2d85d9ab02dbe8566e0683b55aa6db6cd1a9b8084a0c55045c8f8965953fd68b98f9bbf2cc84e215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078836, "uuid": "24bb8b07-9128-4cf2-9fcb-849aa7ed3887", "value": "T14544BE22B3D1C032D663063449B1C6B15E7BBC729BB555CF2B942B3E0E70AD09B7539A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078836, "uuid": "0eb5da76-5d7a-4bf8-ae7a-9dbae7109dd9", "value": "b47cf3c5038ad34425cf7f361b3395f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078836, "uuid": "c54ffbd3-9459-4028-9446-d3dbf6c314e6", "value": "3072:tgHvnJkItfzNYaeeFwZYshZ2jUAea0YSEgKf1FT82YJILBjB5etzK8k6IP0EL5:tOvbxziywZYsHAR0tEgKo9ILxL2bkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694078836, "uuid": "797f556c-4558-432d-92b2-775f8ac6958e", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694078836, "uuid": "2390a376-2d6f-49e3-b085-77c0a276174e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694078836, "uuid": "a3dc8b31-cfd0-4274-b5e9-dfd9da682456", "value": "9a2285586984651e14965cf583f905a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0349bfee-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694103437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103437, "uuid": "3eac8218-34fa-4b93-9dce-86d6e6aaccfa", "comment": "Malware payload (Fabookie)", "value": "7d87f2eeab483a1fa12d9d111e3d6eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103437, "uuid": "751b0d93-f051-4f48-b70d-fd1a8d7419a8", "comment": "Malware payload (Fabookie)", "value": "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103437, "uuid": "9505d086-f2c7-4c26-874b-be755a179436", "comment": "Malware payload (Fabookie)", "value": "5b70e04bac452917f15c6399e5908c55733210d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103437, "uuid": "8165d826-449b-4105-b63d-6b7713c856cb", "comment": "Malware payload (Fabookie)", "value": "3556af65231a794a805773f8acdf80731869c40968d1efc4f6d70e69980b3932d58e3be093b07a7e5893d1a70030adcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103437, "uuid": "70e69b6f-d41f-41f5-85f5-0a69b26424d8", "value": "T1ADD46B05B6A84361E172D17E9AA3C759D6F23C050B30DBCB5251D7BA2E33EE5893A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103437, "uuid": "4a44b647-68c4-40f2-86e9-d2fc649ebd25", "value": "4e0a85626bc84547f95c57b481d13371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103437, "uuid": "0d984ada-c4eb-48aa-9045-841ee4b23073", "value": "12288:2quFbYJO3VldEX5fYwerPZpdqx5yfndmLB:2qObuUd7Pzdqrem9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103437, "uuid": "fd6408c5-b869-46ea-8560-57be7206c432", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103437, "uuid": "dbcbaf82-14af-45f0-85db-e7d087c600f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103437, "uuid": "47acdb83-9380-4a12-98c3-5f1373ac716c", "value": "7d87f2eeab483a1fa12d9d111e3d6eef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ca65ac-4da6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694109004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109004, "uuid": "ae5afc9c-3cd8-4333-a168-33bba88dae65", "comment": "Malware payload (Mirai)", "value": "6b19e8f73332a553464c846601ad829c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109004, "uuid": "6cea1aef-480e-4a73-beb5-a040956f1bbe", "comment": "Malware payload (Mirai)", "value": "ba82725911e52bf660e0899a962fc288271ffb7ef5db488dcd82fe953d4e7f1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109004, "uuid": "a78e40ea-bd2c-4c5b-832f-ce39f205d3d1", "comment": "Malware payload (Mirai)", "value": "8f876d83e39a66828045507d65520084606dfb3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694109004, "uuid": "9c5f9845-fd1b-4ed4-bbf3-7d4468ff078e", "comment": "Malware payload (Mirai)", "value": "cc4db908bb5df734c7b4c0e408873ff14e98f0a7a32745d0d808a852aada5cb2bdc1f86f6e85fc18df045256ffefbc2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109004, "uuid": "077f5291-69dc-440e-9036-85977398d7e1", "value": "T1C8A2E019BF1C868BC8367A7555D9EAD21293FC61F29CDC096940D16FF0A33A91830F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109004, "uuid": "f7a22f70-3ad7-4103-8fec-8f3d8d0a62b3", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTb:O98o08kxofBE+ZkXaITbp2F2TWul0c5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694109004, "uuid": "c9b1fa66-321f-4ff0-923a-7c5e5823a7eb", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694109004, "uuid": "d84a30a8-f7ae-4295-949b-1c6a1fbcc53a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694109004, "uuid": "a7adf724-12fa-411e-96b4-32056389e089", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33520562-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075600, "uuid": "e3c106d4-dc06-46ee-8c63-54915b3c1994", "comment": "Malware payload (ConnectWise)", "value": "55c7a6f7e19f1f49e755499eb4606d96", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075600, "uuid": "a65a2af5-f91f-419f-9af8-11fc1b076612", "comment": "Malware payload (ConnectWise)", "value": "bacbb1c83c5bcaf68ac995946334c9bd1bc0eb97db288d873434a1b006824c4a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075600, "uuid": "3c1d67c3-459b-4a98-b690-404192331c1a", "comment": "Malware payload (ConnectWise)", "value": "7ec5fd859c4825311b5d99107f44d810eb59e3fb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075600, "uuid": "e19ec519-1726-4932-8ef4-aa6fcdc82be8", "comment": "Malware payload (ConnectWise)", "value": "7703c50cc1e9d8e5051cb4846a464e72aa1136b88246764c7f4291af9f7d8505a94ee2d55675eb18fd00b882657e6e73", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075600, "uuid": "4b938946-81b7-495e-bbad-5e88fe1c0792", "value": "T115835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075600, "uuid": "c41f614c-47f1-454b-affb-95e7fdcdf109", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075600, "uuid": "3dda42b7-1fde-4481-a69e-6393550faae9", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3fk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075600, "uuid": "88dc6c30-dc00-4cb6-b639-39d3fb8459d0", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075600, "uuid": "69b591dc-eb22-47b4-81e4-043f740bb799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075600, "uuid": "f627aa09-6427-46c0-86e7-b2890bd72cf3", "value": "55c7a6f7e19f1f49e755499eb4606d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de015767-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694071162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071162, "uuid": "02677fef-d697-4441-8188-2ec2034ec391", "comment": "Malware payload (RemcosRAT)", "value": "5920eceac3f06f57c51c31556ea93c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071162, "uuid": "182709b1-f2d7-4872-a3e5-0f1c4d359fe0", "comment": "Malware payload (RemcosRAT)", "value": "bad6dc695ec91155fbf548d43e3039c1b694db28c1a713b81ecc2d59674635cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071162, "uuid": "12d024c1-ad47-4f21-ae3d-8ac2aa952eda", "comment": "Malware payload (RemcosRAT)", "value": "0abf9fd7d92882306a50a5090769eef686240f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071162, "uuid": "dcc18d92-9237-470b-9ea2-abee7c290e74", "comment": "Malware payload (RemcosRAT)", "value": "9f4bfe8d52ef93634b50f9bfd4b768deae740913574f851882da182714af1430e2ad3d100b645deed24bae996664cf74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071162, "uuid": "3b7286db-d5e7-4adf-8e45-3b33f49760ec", "value": "T1E5B4F112B691C036E1532934597186655A3BFCF29F656ACB3BE43E3E6E713D08A3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071162, "uuid": "b1dc1667-0d28-48fc-bab9-8f7ce47c4cc2", "value": "d5b70e22276decc41f732fe8162e7fe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071162, "uuid": "95c3fb83-ee52-422a-8737-6918ccdaae8d", "value": "12288:HPE3oqyhqQk3d2jKru7FNuR9GxspK2BK:HPEYqyTkmfFNu2xqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071162, "uuid": "cb40c9c5-c489-4c6a-9a91-3077bf547769", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071162, "uuid": "e8dc8874-0c1b-424e-a9d1-8521a9020cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071162, "uuid": "956239d2-16ff-46e1-9e41-45a88ddfabec", "value": "zapytanie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c610e33d-4d7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LucaStealer)", "timestamp": 1694090449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090449, "uuid": "4c91dd32-6251-4a05-af27-45f537b48317", "comment": "Malware payload (LucaStealer)", "value": "0b61f6fcf7864a2f87d91e3a1eecf340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090449, "uuid": "7a2ddfcc-c073-47a8-ae32-32f60318e021", "comment": "Malware payload (LucaStealer)", "value": "bbce6e4e32e181468d77eaf31f1d6929194ea3631977367fb6aa678d8f66344f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090449, "uuid": "8c6fa6e1-7a13-4a5b-a2dd-f24862ec6af9", "comment": "Malware payload (LucaStealer)", "value": "104a099a866204117bad60c22a9ef35a8865a56a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090449, "uuid": "0f0d35bf-78ad-44e3-843f-34ba50dcb147", "comment": "Malware payload (LucaStealer)", "value": "872a9f5de13e4659a03107e564c4c649340922fe638b75d45b322cc25001f9b6c0cbc5f6553d474ebeb19c7d9bcf28d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LucaStealer", "colour": "#E93A1C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090449, "uuid": "641a0fc4-9a2e-46ad-8193-034fbc22ebca", "value": "T1B7C67C217286C43BD66701B12A2DDA9F5538BE720BB154CBB3DC2E6E5BB44C21336E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090449, "uuid": "9c66eff5-2f6e-4a4d-b983-63c33c843b98", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090449, "uuid": "3eeef253-ee3c-4175-8985-5354b0dcb19e", "value": "196608:Qfl0kYa05bfl0kYa0s05Swz/ic6c+sfh/0Pe:KRYXRYtSOiefd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090449, "uuid": "f9cf4593-223c-4791-9243-5335442004ec", "value": 11824016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090449, "uuid": "991bcd24-e478-4903-872f-61a721e3de9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090449, "uuid": "f9a89269-ba46-4882-8374-c5f7e4ec37ee", "value": "bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e1e6f1-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075126, "uuid": "8f35fa06-88ef-4ec8-8957-2edf7c5144c2", "comment": "Malware payload (ConnectWise)", "value": "9e54df80b0de837df60024537ff5e7f3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075126, "uuid": "15392715-2791-498e-8801-298b42a9effb", "comment": "Malware payload (ConnectWise)", "value": "bbd33603cc5f11a1570f93ed1af4076d6a704902cc0eff305792c7cfb0a84d15", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075126, "uuid": "6c730ad9-5fc3-42f2-b6c7-50411e6034bd", "comment": "Malware payload (ConnectWise)", "value": "c9c3ae76f60746accbe0239214db21a7fc5b2b4b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075126, "uuid": "ae07b6f7-d562-4baa-89d1-6f795867c3bf", "comment": "Malware payload (ConnectWise)", "value": "e45375b7700dbb50acaf6ac9d7d24844d195eaaf719d6cb0e826a29b0720fd8da0566b093092d5ec3fa05d50e0938f5e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075126, "uuid": "5cef31c1-f5b9-4ec0-88b5-7280d51b8206", "value": "T14246F112B3D591B5D0BF0638D4795666A774BC088322C76F6394BE6D6D33B808E223B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075126, "uuid": "ad942476-7a62-4d07-982f-e40de2f6815f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075126, "uuid": "dca684af-ebb7-4518-b46a-7e241e9a9dd2", "value": "98304:bfmE6+6efPU3nWn4bGbq6adYdsrGLPygQfpBV:bMefPUoWnsPygIpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075126, "uuid": "52c20fac-1a39-4d0c-bda9-13e16ec0a459", "value": 5473040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075126, "uuid": "5ca60f17-634f-42df-bf64-054faf469581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075126, "uuid": "f40cf4e6-3d64-4179-965d-45f8979bfb4a", "value": "9e54df80b0de837df60024537ff5e7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e9b6c1-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079686, "uuid": "08899a65-cbeb-4747-9a95-6050de48b934", "comment": "Malware payload (Mirai)", "value": "23a32368ac0cc1ede9fe8869b69f4995", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079686, "uuid": "f611a084-4bea-4eb7-a504-0666bb1fd71c", "comment": "Malware payload (Mirai)", "value": "bc5642298b2f34fac2f6101beb47a088f730c61633ae2a0e6721ed082ecab2c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079686, "uuid": "b1515af1-5ace-4c85-b396-9fafce62fb65", "comment": "Malware payload (Mirai)", "value": "82680b4991d744730b6f73ce3c759b9ebf47f792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079686, "uuid": "2cc95a9a-4ecc-4347-b80c-9782d17569a9", "comment": "Malware payload (Mirai)", "value": "2adfcb3eba7eea71442cf24eef1a2ad9e115eba0f19cee6788b1d174a4b732ae9aee8e4ced7daec0773e3850da4cc64f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079686, "uuid": "4a4c2248-b06d-4158-8d07-1c34800bb44a", "value": "T128C2E1BC7DFB6F87CA1A0035689CEF3782B065A5D35B7697B2444006BC131E5AE27C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079686, "uuid": "759f38c7-5c2b-481e-ab20-13771024d4e0", "value": "384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjWdOO:qMw4DZdFbBy6x3K/KdWnH5tEFU0Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079686, "uuid": "9ea4b450-ad59-4f0b-97f1-4cb834aa10e8", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079686, "uuid": "24dcd7b5-b1f2-43f6-891d-e9413446deb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079686, "uuid": "d92baa58-67d1-404d-af15-3e4012350626", "value": "23a32368ac0cc1ede9fe8869b69f4995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e24caf5-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075618, "uuid": "27886c75-5582-498d-adb8-26c1f46dd5eb", "comment": "Malware payload (ConnectWise)", "value": "68ad1ffd502d5a52b36004e521b75b6b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075618, "uuid": "de591261-a0fe-4a0c-92ba-6f507c62a78e", "comment": "Malware payload (ConnectWise)", "value": "bc97d3609d1c875882ed4a30f76b9a79ebf571c865ed42c5ac190f0536d0580d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075618, "uuid": "ccb62bc4-35a3-44b3-9496-8a84267c626d", "comment": "Malware payload (ConnectWise)", "value": "878549afa0b09e031ad41cf8569c68ed5ee4e6cd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075618, "uuid": "82b3f8ac-4c18-4515-8e66-652296576f46", "comment": "Malware payload (ConnectWise)", "value": "98c9acbcae4811d91d67f89e53e8c5ce22522889eb60bf0dac0fb75a275eb2aad3378d8248e54034b121f5cce1962fb6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075618, "uuid": "74742962-3258-49b9-b874-99dcfb26688b", "value": "T14F835B13B5D18475E8B20E3118B1D9F4593F7D114E648EAB2398427E0F352D1AE3AEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075618, "uuid": "12f20e6b-cce7-4fb2-a5fa-ad6482dcec08", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075618, "uuid": "2355471e-3efc-400b-b6d7-49ca999a6d46", "value": "1536:EazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QtPxB:QFNpo6rIKlUE8fbkqRfbaQlaYY2KxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075618, "uuid": "e6efae29-b76c-43cf-846e-cce26a2e67a7", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075618, "uuid": "7948f685-4f3f-4054-a933-c01e0ce7ced5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075618, "uuid": "9e8a10c1-6597-4ce5-a4da-a893e5492a76", "value": "68ad1ffd502d5a52b36004e521b75b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757bb756-4d22-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052089, "uuid": "0b359d61-bf75-41c1-8a12-b9f245514321", "comment": "Malware payload (Amadey)", "value": "5fab74904acef74c636edf1fdbeed84b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052089, "uuid": "2f001195-b664-4048-886f-2db56c56f787", "comment": "Malware payload (Amadey)", "value": "bca5d1875bae11760bc7af3651ce2a98dfc86d4df1f03402ab82fdcacf8e0a21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052089, "uuid": "09e8437f-c28f-4f77-a62e-7ecb08c5ff65", "comment": "Malware payload (Amadey)", "value": "02e3a0e4e1437f18084544641fb37821423548ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052089, "uuid": "4cc74c4f-a171-4772-8817-32f1a4387071", "comment": "Malware payload (Amadey)", "value": "28fe84ee7a779a7c2dc765fb599675bf236090230c3d30e7c75fde161293d74c92e63376cd60a8f291487b8ced1af6af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052089, "uuid": "27963613-7436-4258-ad68-81c480181f87", "value": "T13E24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052089, "uuid": "9901fd14-9bdb-4c34-b825-6ecf1222d831", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052089, "uuid": "c80191c6-d581-4053-bad0-36aea82416f9", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052089, "uuid": "e06b70f5-1e94-4442-9092-88f4085c0962", "value": 225621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052089, "uuid": "cfbf6191-aa65-4291-a4b7-32dc9ec745bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052089, "uuid": "029d51fa-e692-4b5e-a97e-d85a2e66f43b", "value": "5fab74904acef74c636edf1fdbeed84b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117e6c34-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694107755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107755, "uuid": "494b7b99-b50c-4dcd-903f-ee1dafbd23a4", "comment": "Malware payload (Mirai)", "value": "0bac1245f60c42531894bc5b27d9a3e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107755, "uuid": "ebaa92f9-e8a0-4bdf-8f9d-e1df66f540c8", "comment": "Malware payload (Mirai)", "value": "bceebc305935b3e1a67673df2ddf6f2bb03cc713a8bcd5f47d69b22522a456c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107755, "uuid": "1a3f30de-c0ed-4966-9793-ab32f19d16d3", "comment": "Malware payload (Mirai)", "value": "cabafe09b471f792b3a3a75f97da902fc898ab97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107755, "uuid": "75a0765e-939d-436b-96df-237be2a35a5b", "comment": "Malware payload (Mirai)", "value": "91433838f64fa1aff8e5ba8caf28491da43c85f88bb6b12650b6ee2c8f24cbd0c5e4cdd6ce13b6aaa957749c1813b98b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107755, "uuid": "3c11698e-ea83-4e60-bbe7-e27a97c9f28b", "value": "T11D93A409BFA06EF7E8AFCC3745E9175624CD5A1721A87F75B930D818B20B24B16D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107755, "uuid": "4efac4e3-730f-4e38-835c-c271cf2aa679", "value": "768:RgEoEQcXHQfY13RBvs/5D/G5qXR/x3EVvcSG5fWe9eVweoynuEtwK1xcaIsXi4nI:R8EuY13AV//x3e/GQcww7ym0KFSaSFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694107755, "uuid": "7c265ab3-c97d-48df-aa3d-a2ae797e899e", "value": 92880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694107755, "uuid": "67f79526-29e0-44b3-bc1e-bb4a42c6afce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107755, "uuid": "cb47cff6-d7ac-490b-a3e2-a6d71da39cde", "value": "0bac1245f60c42531894bc5b27d9a3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd63dd6-4db1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694113547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113547, "uuid": "9cc9de53-c439-40c8-a4a2-59bc8b11744a", "comment": "Malware payload (Mirai)", "value": "39253ddfd3f0cb9726fe8c9a885c45ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113547, "uuid": "9e18bd68-ada2-4bc8-816f-5eaf648509f0", "comment": "Malware payload (Mirai)", "value": "bcfddea4afce23928629accbcba77d6e9bef81f4d22487457a7e7a533f58f498", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113547, "uuid": "3164a525-e3b7-4b35-ac10-071326c97147", "comment": "Malware payload (Mirai)", "value": "4a94ba1443597dd5cc3b94441e37a39a2ab1799c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113547, "uuid": "0e909860-d4cc-4f23-ac63-abe84cd61bac", "comment": "Malware payload (Mirai)", "value": "b44e7fb23644d84179343df9dd8ef084071ab6be9ed3b8271ea256a5f20a153fb010be33165aa3438c216089574eb0f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113547, "uuid": "29b8fb17-0c8f-4ec2-b071-428a5453530c", "value": "T10C03F195F4C400B1D3752EFEFC26CAC3AA5D3D79A0AA925706058279AEC089535F94E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113547, "uuid": "5738cdc1-b60c-47ba-8374-81e7dfd3b1b6", "value": "768:vkJ56p6b4bQr79+E2g6S7xUZ3tgYISdwFQY9JetC8dtsyjM1Uyq3Uirbb:C4p6b4c30E2m7xUfgidXI3R1Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694113547, "uuid": "952d4407-a91f-4d58-8839-2e470e29a414", "value": 41124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694113547, "uuid": "b7d308f9-f798-4d52-acc7-0d4404b179e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113547, "uuid": "88a4e3b6-db3f-4f9a-919a-36d03cdb7536", "value": "39253ddfd3f0cb9726fe8c9a885c45ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6205ad-4daf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694112605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112605, "uuid": "192b82a1-80b7-41c0-841e-712c0cae5046", "comment": "Malware payload (Mirai)", "value": "f0f85b316a0c4ea16154b3104f3103b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112605, "uuid": "b5ea4bc7-b45b-48e3-868e-b96d604afc11", "comment": "Malware payload (Mirai)", "value": "bd204faa792d36f18b3bbd03a805cd73dd22087f4878db775f81f8bff7aeed1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112605, "uuid": "c34d7c12-3269-4175-8e0e-87ca6686c4ef", "comment": "Malware payload (Mirai)", "value": "d97ebe5a7bb645a40c137c5e5903f96bd66832ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694112605, "uuid": "05bc4c1c-6324-48ea-88da-4797190a3e43", "comment": "Malware payload (Mirai)", "value": "890ec5bcde47efb66660c4cdae72f5d4ffd4ef6ac47dd568e6e1a11e3f8a54746cae61757799442dff7a299ab2382736", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112605, "uuid": "df8d7dd0-2b43-4679-a921-87c7e65d6bcd", "value": "T171530144996DC501C5E06875562A995C3AAF2FA081BC77EF3242C314FA98E32CF8D5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112605, "uuid": "1e272c65-dd14-482d-9a5f-7f4127e30437", "value": "1536:BeIqfnocUDwSSrDez+0qFRiKhAjkWnPX0CyGs:BeIen5UD3owqFX2RnPkCyGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694112605, "uuid": "8f99261f-020f-412f-b831-2e970e1d5de4", "value": 63304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694112605, "uuid": "b7e7e85d-edc5-4a40-bae7-7083db33995f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694112605, "uuid": "a01c56b5-dd4d-4e6a-acda-75d412b93ed6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42528dd5-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694075196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075196, "uuid": "1f907ad4-60c5-4d54-ba38-f6e013a2943e", "comment": "Malware payload", "value": "e37a2fe7992506bd8942275786859703", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075196, "uuid": "262f4d3e-96a6-4ca0-8cbf-91d983b120cf", "comment": "Malware payload", "value": "bd9523a1ca548fb43c47de22febb8739f34afcba2843d6577a18759110deecbd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075196, "uuid": "e3871d0f-041a-4457-9001-1baa01c1db23", "comment": "Malware payload", "value": "784dc9365f00dc656a63cc328d6fd5992793d1bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075196, "uuid": "dcc06b7b-cf63-4a09-ae4c-d872641bef95", "comment": "Malware payload", "value": "f07122231a31b08025b0093aa3a0379c9564986f0c0852d2c9c455e033e64dfb9d169c691519651e25943e6e136493ff", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075196, "uuid": "ad2e9bed-52fa-4512-a886-7203f92624df", "value": "T11B267D31B24AC42BDA6201B01A2C9BDF5528BF650FB554C7B3DC2E6E1BB45C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075196, "uuid": "ac112dcc-b95e-4056-af9e-6c41479afe7f", "value": "4d363d3b473a6c355539abd95921390d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075196, "uuid": "f14bb0e2-6946-4df2-8cd0-aa373a941d4f", "value": "49152:tyDQkeCmaxbwAgIubaJY7Qyo3r0K0BsBacA654JOh24Th3pCd4OnJm6gEwHHYwkt:tyDQkeSLhuba4o3r0fCjAhcgUma6tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075196, "uuid": "0177182a-b361-4009-a76b-35f3764abd7f", "value": 4484743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075196, "uuid": "858ccd8e-e3e0-49fa-bd11-9265c4f0656b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075196, "uuid": "90115ef9-6a67-42c8-885f-8496da4b442c", "value": "e37a2fe7992506bd8942275786859703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd07c2d0-4d7e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694091830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091830, "uuid": "f1b727e5-a15c-4833-8b8e-b84ec815be87", "comment": "Malware payload (AgentTesla)", "value": "1f74af08d08a1fbb24f7a9f46016175f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091830, "uuid": "92272551-a296-44d8-8ff2-bf64e45f7b76", "comment": "Malware payload (AgentTesla)", "value": "be3e33e623ee03410108daa0edf6395c15d53bb8e81102c5f6023ba2894232ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091830, "uuid": "af60741d-253d-4230-a740-781c7bcfbb46", "comment": "Malware payload (AgentTesla)", "value": "6572ececc3dba5df5357c6f7de074219ab0daff9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091830, "uuid": "ce06bc06-e25d-4a58-9fd4-e4b23ed28a66", "comment": "Malware payload (AgentTesla)", "value": "464b330197fc62c34971e37ea2acb93f3fa92fd27074b53df028694635a6e89033d94030f1302162e31525f9db9d560c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091830, "uuid": "393dd6ff-a6af-4e95-a8eb-712549d22753", "value": "T19F44DD037E48EB11E6983D37C3EF6C2413F2A4C71673820BAF49AE6529416536D6E36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091830, "uuid": "24326ebb-6153-421a-b6a9-6dd30d4991a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091830, "uuid": "b504699a-643b-41ec-985c-684a1bb67df5", "value": "1536:xz1GluVWIMdfmNmilyt0el7nRY50miU0qk+4pf2uCKA1OK5ge0YfwRsCsyf/U5dL:xsluvYilT2zmifFU/J6W2WwfztE4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694091830, "uuid": "2f67be06-d9c1-417a-a68f-f18f28143ffa", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694091830, "uuid": "4f738b65-c2fb-42ff-b623-fc327d258bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091830, "uuid": "7e3b6cb5-04a0-4a37-bd13-155b3f8fafe3", "value": "be3e33e623ee03410108daa0edf6395c15d53bb8e81102c5f6023ba2894232ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd4c232-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096663, "uuid": "ed1979ec-bc9c-43be-aac2-d736518b0712", "comment": "Malware payload", "value": "317b50c592ee305b426fb21965473cb1", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096663, "uuid": "b0bc14f7-21f0-4b9d-b694-bf142d2b6599", "comment": "Malware payload", "value": "be811e7a20c98b80cebbaf57f6f7a63d787aa4208dff3c6d2418c7fd7dc0a86e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096663, "uuid": "898a58cf-3e9f-4b42-88d9-4d1048837781", "comment": "Malware payload", "value": "d3d6605ea4e8b22f611993e57c621641b923e87e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096663, "uuid": "3aeabd65-d539-40b9-b111-ed418430b9ef", "comment": "Malware payload", "value": "84b12580bcc503e656222c1e6ab931634d72064f30eefef279806353ef66e167e90b273a7bfbf0091dd59e77a482e37f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096663, "uuid": "400d546a-13a6-4cb9-929c-4b7f096a6e30", "value": "T1D7C402AC1559A7C7C0999FFE22E316234DE414EB9C23BF4BF954E5CAD4D2A823413863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096663, "uuid": "037c0126-004f-4820-8f2d-8e3cea95c0e2", "value": "12288:z9zA0578/NVjms9K8UFiTzsh1syHj5lHEcLEZdFem7PHd7:ztA0578/NVjms9K8s8M1fHnKReg/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096663, "uuid": "7d0c69eb-dfd8-4cb1-9c10-f21f6b7eb16b", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096663, "uuid": "93d4cf14-5113-4bab-8241-5b1f30d5109b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096663, "uuid": "3d0b4e5c-246c-4320-a4db-e2d09d0d60ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c42334-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103808, "uuid": "23d729d0-32da-458d-93d9-81b9ae4b6786", "comment": "Malware payload", "value": "bcb800b86a2b615d9205e24192abb136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103808, "uuid": "fb6a1513-2c70-41e7-ad2e-56678de4b6f7", "comment": "Malware payload", "value": "bf1f92e316a65678c025d3a24241f825fe7c306e36a693f511f2d0461b32140b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103808, "uuid": "2eadd276-e520-4ed4-bbcc-70159b71ed5c", "comment": "Malware payload", "value": "f205f5bc5565e9d02dd999d0e95317d2fc1440e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103808, "uuid": "c3202435-e9ef-4c0f-85c8-de833c9c6e59", "comment": "Malware payload", "value": "1ea3b845ab637c36e24bc1e6eb263f386e056665da99ec515d35e7b26a6f16ed94a73fff4b42e55f204a5cfe73b3e57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103808, "uuid": "f1f966e3-940c-44cb-9283-52891997b8a5", "value": "T147463812B36A6888C3148C38853042B651E7BFC76BFD51E7D4F69D347AA13C05B7D2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103808, "uuid": "d20505f3-b074-450d-b0b5-c76b20666f81", "value": "48246eb64cb05f56f073f843df37a04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103808, "uuid": "998fadca-9e5c-46e6-a4a3-7770b97c2954", "value": "98304:efWoBTNfB2tncBrQrLfYjwQsGwy69HeV9/Ge7wNHi:e+oBTNUtncBrQrLfYjWTyUHS/p7+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103808, "uuid": "0bd17b0f-e779-43cb-b73f-7a5bfb19ddf1", "value": 5638128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103808, "uuid": "b3042f3f-0d03-4ce2-ab46-98cb5c59ea0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103808, "uuid": "c3a6e089-5c54-4fdb-9621-a2fdc2d88465", "value": "bcb800b86a2b615d9205e24192abb136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00432660-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694090547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090547, "uuid": "a5fcd870-62d4-4ab9-9ec9-8544c3ca7e3a", "comment": "Malware payload (Smoke Loader)", "value": "1fe980382358e997c10f049e84330d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090547, "uuid": "b37d9c1f-6560-4dd1-bb85-85f5b0c157af", "comment": "Malware payload (Smoke Loader)", "value": "bf45cffa36b4ca6f6734636ec005ab078b46c735becc21c566b622172a446e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090547, "uuid": "b0cf51aa-111b-46c6-916c-eeaa28c46343", "comment": "Malware payload (Smoke Loader)", "value": "99a9aab064b824ea6f75f01c97998e742f935818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090547, "uuid": "b836d03a-df14-483a-8487-2944d2e7e42e", "comment": "Malware payload (Smoke Loader)", "value": "5a7a0d3dc0aac3be0a1ea216f8310997805e63434bf1aaf2d25b34ea861ff7b2510fdbc5c834dcfe16c9e5cbc413c87a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090547, "uuid": "16957d10-7a0a-45b4-a513-9c0de91ad70c", "value": "T112646C33A2E16871E5230631CEAAD6E4AA1EF8E14F55B7EB13549AEF0D701E1C17E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090547, "uuid": "978c4cee-2dd5-4dad-bba7-14506d1fddc5", "value": "6200f2b320af277fec49ce04b92f1379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090547, "uuid": "9072f83f-92e1-429c-98b3-338a37518845", "value": "6144:vHGvjwdHX72xwle+jmNIQ7HpbqTYsa7TGO:fiwd3SOlVqN37HpURaPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090547, "uuid": "dafd4725-e747-43ab-843e-d5178d30cb7e", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090547, "uuid": "7a1275dd-82d5-49eb-be3a-36e3333f9130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090547, "uuid": "de8d6795-ae49-4818-ad6d-23bcf8985dc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f523d3-4d90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694099473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099473, "uuid": "bc068f80-6105-4f59-88f9-bd349fe6b4f4", "comment": "Malware payload", "value": "1a930dba9d331d0272f715aaa131a631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099473, "uuid": "2f25beb9-758d-4e7a-8dbb-ec120a3c64ec", "comment": "Malware payload", "value": "bf495c5a855f4b1310fcf361ed2c60eff29d16be51a56c7b15609599fe55dd64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099473, "uuid": "191f6e49-8ebe-40cf-9aa8-0375d656c7c3", "comment": "Malware payload", "value": "8b20898f6f3fa8165be2e0f817161d1fad3629db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099473, "uuid": "e486122f-68e9-46b8-994d-abc033e3a8d0", "comment": "Malware payload", "value": "91da627698255cdbecd56885f1268f2334fdb7f30acdce556d273b6016cbdc46b9b018eec973cdfd54bc7f89d3b648c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099473, "uuid": "f369e629-9f9e-4916-8618-5cc3241139e8", "value": "T189C5339F54F1592DC7485D3A33817F7B4BBABE8B38074865B2AA041D484B1E18E27DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099473, "uuid": "e246d86c-267d-4a2c-bcf0-baf4ded985e4", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099473, "uuid": "33fa300e-30f7-4295-9168-f43a168caadd", "value": "49152:BTowa7AC/AVNMzR11uzjnaL5xKnBskL6d1VOHHOavKTcvzECBSr:Ba7VAqAzjnqUBPL645vuOSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694099473, "uuid": "ee316b79-7a93-4db9-a64b-f459bcf8d0f1", "value": 2659304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694099473, "uuid": "38fb3ed4-1671-48f2-9986-f9acff9eb7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099473, "uuid": "f7bfdf2a-41e7-4758-bf4f-a0ebf715c956", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6712ba3d-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694102745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102745, "uuid": "542fdf60-5122-437d-8a19-f3b76492d436", "comment": "Malware payload (Mirai)", "value": "b51e01a47eb92134517386ffc6a66c57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102745, "uuid": "9c0b0899-a627-45a0-8814-05265c28591c", "comment": "Malware payload (Mirai)", "value": "bf5f773829b8b0a5eec7f1a1e168f86c8ba877a3bf46286e2591656fca700276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102745, "uuid": "683340d8-bb58-4615-8a29-8d552aa7853c", "comment": "Malware payload (Mirai)", "value": "8ab52894374a9c87ff928e8b3b5e204ee0548a5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102745, "uuid": "fae65c5e-c1c0-4bfa-9907-4fb0cbcb865b", "comment": "Malware payload (Mirai)", "value": "12bac64870f925c83c7af8bb266b3174b2d7ec8ebc578a07a0b6c5038fc7b437b09747efda86bef4abe1d56d8532139e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102745, "uuid": "c734bae4-344f-4850-b7ff-9662374f25b1", "value": "T181E2F121691A847EEB30C871E0F5458777692BBC79FEB1B24462060DDCC394293E1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102745, "uuid": "8091b98b-755c-4122-a610-dc029097d0f7", "value": "768:wEKkUgXAnURCr6HmDFStmYtn7bLM9q3UELd1:IkEn7uHEem8HVL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102745, "uuid": "ea4fc8c0-b857-462a-a061-96b4cd73673c", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102745, "uuid": "01316daa-17de-44e0-848d-8d8203b96088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102745, "uuid": "7b35ea1c-bb15-4779-9170-8c7bb5fe26c9", "value": "b51e01a47eb92134517386ffc6a66c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ba3288-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071087, "uuid": "59b40ff2-d631-48f9-915b-a8e4ff995002", "comment": "Malware payload (Mirai)", "value": "973b61471ce245995864971b7807ed3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071087, "uuid": "a6ab6613-4f9b-43e8-98d1-9a6fc9f6984d", "comment": "Malware payload (Mirai)", "value": "c010057569e8660706ae0ddcde6689b2de776a7f94b3b5cb4309462cc2b7dc13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071087, "uuid": "92f67c22-fd62-4e56-88b8-7377ad1657b4", "comment": "Malware payload (Mirai)", "value": "758e3ad732f3ea6cc18392c4c54e261327ea7f5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071087, "uuid": "6400d269-22b2-4dc8-a7d7-60c24be6adff", "comment": "Malware payload (Mirai)", "value": "6e173603f72282afa7a94d7598177ea7ba4ee9a50a440da207a2453cfcf7fb48d8895effc480397cdee9da0acf411d09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071087, "uuid": "ba7550c8-35bc-4925-b954-91c1159d84c3", "value": "T1E3539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071087, "uuid": "ec6df2d4-597b-4955-8c28-6083c65f0b8c", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071087, "uuid": "015475c6-3cae-48d3-9435-c3a4a8e8a287", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071087, "uuid": "4fc11e45-821b-4122-8f74-e93cd4d81fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071087, "uuid": "e0f2ecdc-de8d-4e39-8134-c3feac3ce04c", "value": "973b61471ce245995864971b7807ed3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287bc711-4dc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694122397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122397, "uuid": "dde8ec97-cff8-4ef6-a58e-c9dc0ac41f9a", "comment": "Malware payload", "value": "10f478d0d0ced59cb3d5558abb9df7d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122397, "uuid": "d8cb5523-c946-4a9c-8d39-40a8bf4ea6d5", "comment": "Malware payload", "value": "c062d589d7d1620d80b5b5d5bc42616181da55be9cdafed8f05d222369bf03a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122397, "uuid": "abf092b9-2bea-4743-aeaa-220f98267dfe", "comment": "Malware payload", "value": "8dd139efe1ed5164eb8f68a7f1e46d390c06c58b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122397, "uuid": "1fb7b5fe-31a0-4ea4-82c5-2e172029799c", "comment": "Malware payload", "value": "975987d31162faa59327fbf2ca79b9873426df7b2f60b1eba2bfeaf6eafc303fd6789500ed6aacbd6086e503a971bbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122397, "uuid": "1946189f-d96c-40c5-9333-44b8246280be", "value": "T12D449D44B5CE807ADA719435CD94D9765FBEE8202A71B1CF73CD067ACA781E2C3618E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122397, "uuid": "8a2f2882-72aa-4816-9571-16149367ca50", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122397, "uuid": "b8266ebf-fa0a-4544-907b-b393e485dbc6", "value": "6144:xb6PWJ9nd1kCh2EonANdOaEpGvKPQr/mlOKfOQ+8ZUZ:xGCHkC7dLJCPQTml3OaUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122397, "uuid": "43cd5e5b-930d-460b-86f6-b4f9635e8b52", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122397, "uuid": "2ccd773d-77a4-4979-8202-18b46b8a7882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122397, "uuid": "3bf5c2d4-f4fb-416b-9a3a-265f83ff3c44", "value": "SecuriteInfo.com.Trojan.Inject4.60850.1236.2666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24f7a8d-4d4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694071625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071625, "uuid": "0c3a7e1a-ea46-49e1-a55d-0851b0ad8521", "comment": "Malware payload (RedLineStealer)", "value": "83b4438508a3f84c7606266a81a3e079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071625, "uuid": "f612a6b8-774b-424d-ac0b-1fd63ed61150", "comment": "Malware payload (RedLineStealer)", "value": "c07e47bde15ca1a9c186751db362acd62979d421f39eee1d579b558efe932eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071625, "uuid": "8fc309f0-b494-4c05-bce8-21fe7b75e662", "comment": "Malware payload (RedLineStealer)", "value": "a14fd55c012a1a7dd2cad0bb911800739961657c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071625, "uuid": "3211f95d-bd6f-4a70-b80b-55dffd79f49c", "comment": "Malware payload (RedLineStealer)", "value": "163b1db4500ed93e82084d37843f8bb72a99437f4ca9c37904c19db9eb8e71327bfafd48c01d5b566d4df1f406c5b06d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071625, "uuid": "814380a9-94c8-4413-bf4f-cf993183a55e", "value": "T164E41211A6EC9027D8B1177068F603D31F39BEB10D74876B3284995A5EB3684F673B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071625, "uuid": "f7772547-6939-47f8-96f0-b3d6e5fc33eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071625, "uuid": "cddcf216-97cc-4ab8-8af1-3a10e70f8924", "value": "12288:VMrPy90ylB0bn6fPMSXIqIqykYTxmmn4Sl/Ec3bJkiWCiGNrjmTkqnw1Pr:SyZjRBpyv3n4AschJhrwk91Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071625, "uuid": "70b7e0ed-a7bc-4b96-a7d6-3b7244acae5a", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071625, "uuid": "2ca338e4-5796-423a-958b-e8b7181fb267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071625, "uuid": "b6d69977-bcc9-4276-bcac-e14130e7d1bd", "value": "83b4438508a3f84c7606266a81a3e079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c954a5ac-4d79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694089595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089595, "uuid": "3e0e26c4-dc76-4b21-be39-19330de634e0", "comment": "Malware payload (Smoke Loader)", "value": "621fcd9bce5a97ce7e14e1f92f4caacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089595, "uuid": "3dbdee16-c880-47ad-ae57-e95ac8a9188a", "comment": "Malware payload (Smoke Loader)", "value": "c0ad33866c7e012cbdde8d4b3d7fd05bca3070db5fb1f04efb5d1cb0b853e7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089595, "uuid": "0378e6c1-5871-4f34-a1fe-6110be529ab5", "comment": "Malware payload (Smoke Loader)", "value": "9975701a9845f58cef24d246d93432f30f58cbeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089595, "uuid": "ccb03d64-08b5-4913-b981-9309bc1abdd3", "comment": "Malware payload (Smoke Loader)", "value": "90d263791d07a607eb446f3a0239a0987c2c2f5d3a592a3dcc0d934d08a090f27c2d9cf8dbd9e33cd165ecf1bcdd4f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089595, "uuid": "4fd910e7-eb05-4f31-9da8-ffe9961e93f9", "value": "T17A645B1293F16871E62746718E6AC2E82ADEF8E05F5576EB1754AAFF0D703E1C272310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089595, "uuid": "432f3045-8f96-4b5c-b9f2-917bb35608ae", "value": "6200f2b320af277fec49ce04b92f1379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089595, "uuid": "1bb76b2a-ffcc-4ce1-be4c-520ef805d91a", "value": "6144:6aLzvrTi6XBPQj9BgBdUSxvy1wf9yHqO:66HTieBIJBw+i9yHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089595, "uuid": "d071711f-7517-494b-9227-9b64b20115b3", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089595, "uuid": "45bf4064-e0b0-4ca6-a13d-f26cab33f457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089595, "uuid": "3050a055-d8cf-48ec-af40-9add18f204d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d6d378-4d82-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694093475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093475, "uuid": "ab484ccd-068c-4f0f-a8da-da3e0bd0d56a", "comment": "Malware payload", "value": "af28244371f57e33a2e88c631fd64dde", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093475, "uuid": "7ea0d4d8-9c04-4d50-842c-3c3462536ab0", "comment": "Malware payload", "value": "c0c4e7313bfdcfc74b9948e5b27ed2049290f54e07a36a7c0ed474fe15f42dc0", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093475, "uuid": "7612ecad-1914-49fa-86ef-bec7b4b810e9", "comment": "Malware payload", "value": "e17cdd8922941b0b7e712e6fe09659096c30d84c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093475, "uuid": "5a6b17bc-4c69-4cf8-a315-96c4908f1f20", "comment": "Malware payload", "value": "cf2b3fe2c651777297e7d3d196d4086199115d2d6bae1643198c32cc4d606bd25737ee5214d3ddb57a2c0158eacdac08", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093475, "uuid": "30f3adf6-5360-49f9-9c84-59a64f170dcf", "value": "T15C41855B4392317BA3F311A997817003A29580CD6C1F690477DCA11AE7C176B43A7B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093475, "uuid": "45e98098-1e05-4ef6-8eaf-d99e4b7e667a", "value": "48:rujcFXWgxjSvb29XY2CQpScoQ+JwpAikSE09TZOU:regYT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093475, "uuid": "c749c36a-0ca4-459f-8e6f-85f6b7962579", "value": 1988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093475, "uuid": "1a57d7e2-1436-4f67-87ad-fb8ebd16b85c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093475, "uuid": "42faa5c1-4a33-4361-a6b5-35ee3ca048c9", "value": "2u40A5aC.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7196f350-4d4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071409, "uuid": "5a119517-cc55-4edb-a7ba-9efb33953f12", "comment": "Malware payload (Mirai)", "value": "179a74145ad68ab1bc10a1115c125182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071409, "uuid": "93182310-5b37-4023-83fa-f62e60f338e7", "comment": "Malware payload (Mirai)", "value": "c0c667865c3c0ad1f49791eefced00554a0e47730d9b49d4112a030532521a6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071409, "uuid": "fe9e337c-e3d9-4944-b1e9-804957e6181a", "comment": "Malware payload (Mirai)", "value": "9e535184e6b54b86fd22559da2c4dbe1c30d1ac8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071409, "uuid": "d23b255b-bfcc-4599-bb01-7bd0dbb891fb", "comment": "Malware payload (Mirai)", "value": "f5501dffd5c757b0c329ca0fbe9846f6ea516762ef18b548121b6b54c15e035ccac1945a2040d2a21caf22988842915b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071409, "uuid": "788add9e-4056-4a3b-9610-b4b219f5ec5c", "value": "T1C1735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071409, "uuid": "27505af6-24c1-489d-9a70-1bc796cedf2a", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8S:YwfdNu4cmZvFqI3w7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071409, "uuid": "4bc3254b-3695-4d81-8d73-a3792ffa0f59", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071409, "uuid": "d7806e2b-0af6-42ab-95d7-21433e9aa3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071409, "uuid": "1380e9a8-3b5b-4a81-904e-ba764e67b339", "value": "179a74145ad68ab1bc10a1115c125182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f714ba-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694096029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096029, "uuid": "46249aec-f939-40e1-ae33-82f8818a42a8", "comment": "Malware payload (AveMariaRAT)", "value": "b922a07ec7b2e7282ad8fcc8bda9c7fe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096029, "uuid": "83a3ea4e-788e-4f8e-b165-02b0765e7a55", "comment": "Malware payload (AveMariaRAT)", "value": "c0dd28dcff8cab7efb5dae193cb3406bbcab84a311ba449e4d99dd3fb8068039", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096029, "uuid": "1cacadd0-aed8-4765-ac50-c5fa47b4c7e9", "comment": "Malware payload (AveMariaRAT)", "value": "c14fa217b552b5526b31e80b102bc115430e2ad2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096029, "uuid": "d01f7684-5bed-44e6-b18e-6aaaa65548d6", "comment": "Malware payload (AveMariaRAT)", "value": "dd9722f9409039ce31510bce3ba36c8340672fa523f707eece73c3ff6333bdd9f35f8b611db37e740fc7aaa81d8cb3db", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096029, "uuid": "9345302c-fba0-4b36-95e4-00843f9a0cd4", "value": "T1FAE37C327BE188B9E6F6013109F53F398B7DF93111208AAB63905A468D37BCDE955783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096029, "uuid": "22a6b809-2a99-45d7-83e5-805604d3d412", "value": "b9494f92817e4dfbe294ad842e8f1988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096029, "uuid": "44c288ea-1d43-4e6e-a779-4aca7de25f5e", "value": "3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096029, "uuid": "1e3bc354-71ac-49d5-835d-0a2d6780292c", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096029, "uuid": "8cd10c4b-5896-403b-af76-7327d10f4ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096029, "uuid": "a334e6bf-bbc3-4d3c-ba5a-69d45ba998a6", "value": "decode_5a33c71a1ce42de6c6463c0f66d1c1b424ebd9981bb98cfcc2e0761236c8f9cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e01b1a4-4d19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694048184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048184, "uuid": "958b3d5f-7731-484d-a8b9-f743f5a394e7", "comment": "Malware payload (Amadey)", "value": "2fe3ba5c344a89c283fc54e7b0edd406", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048184, "uuid": "720c0972-e663-4ea5-bd60-3895ece7ca28", "comment": "Malware payload (Amadey)", "value": "c0e78bd6b19145db25265d637c7c2763055ddbe4033eba9b1158d6196f10ca23", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048184, "uuid": "13293d89-ec02-4380-af42-097fc9949ba7", "comment": "Malware payload (Amadey)", "value": "cbd6d0912757d221b7fc54a9466d7e23060a1f83", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048184, "uuid": "181369d8-3909-4dcd-be13-4fd7a8541774", "comment": "Malware payload (Amadey)", "value": "511007e9ac731a46d8ab00d5c3d1d62085b0f42a226955525c818dfea638c748ae6c8a0c6675376b0397e75f3e06ea56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048184, "uuid": "5355a89e-f7e5-4ebf-a350-595baa90234e", "value": "T1E7E412429BD40421DDB61B7469F707D71B397C919E38936B768699CB0CB23C4A8313AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048184, "uuid": "a1fe83d0-3409-4e5d-917d-b803b9bc1f15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048184, "uuid": "e0df5454-902f-45db-b90d-09e9eeae8747", "value": "12288:GMrhy90vfoZ6kAzm/J9zPZ1ozBUYCtitIm7SOxvXQCzg1StS1jgSz:zy4AgzaLPZaZtIFOxvXLSCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694048184, "uuid": "81104446-f503-4792-bb35-be608b94c354", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694048184, "uuid": "267c7948-2860-43da-811a-ca7724f9b44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048184, "uuid": "411bc090-07df-4c82-829c-3021b7c6cbb9", "value": "2fe3ba5c344a89c283fc54e7b0edd406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c1e31c-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Urelas)", "timestamp": 1694085080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085080, "uuid": "231e71e1-9d18-40f4-af7b-72ed7b41d885", "comment": "Malware payload (Urelas)", "value": "e9b10daab93116235f71a3d4cba53b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085080, "uuid": "379d53f4-5d6d-45c7-86fb-922708f3ce95", "comment": "Malware payload (Urelas)", "value": "c1cc6f77911d66c708742535e0e8b2a497a87e67384ef8ac328668443de716f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085080, "uuid": "300ca649-389c-4f0c-8ddb-d511d6099aab", "comment": "Malware payload (Urelas)", "value": "f9dc64a142006eedff2388a117a8b8820a8c21ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085080, "uuid": "897bd7fb-46a4-4cc2-b7cd-612577d181d0", "comment": "Malware payload (Urelas)", "value": "ee450e22eef7d31a8ad097ae82f6c90d20bbb562bf353fc434c4f124f43bc0bd10334ede66238bc49a1c0f1d998df083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085080, "uuid": "c4a71abc-a38d-4ec7-86aa-9de2bec6a474", "value": "T10894AD217280807AF3B60B3049A5E6B5086CBC352769958FF764BE3A2E701D3567739F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085080, "uuid": "8ef821cb-58e4-4a8a-81d3-836bf478fe21", "value": "b6852ed4e334147c4929ea4ff7285899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085080, "uuid": "c90082f5-9b8d-42a4-9b77-b019a8b14d3c", "value": "3072:yZ3vlHjQhJ3wE8iGK01Py3Vvsa26nfjQb6uNHG+yi38/rwdusS9V0alO2alNjgS+:oo3wBi+1Py3V0a2WkRNgi3caOHO5Njo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085080, "uuid": "7faf08fe-b8f1-41e4-bbb4-be03796dd9db", "value": 446082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085080, "uuid": "3bfc0256-a9a9-4619-84c0-4b7d2f8e1f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085080, "uuid": "fe0bbcd1-429a-4852-9683-9c599aeeed4b", "value": "Trojan.Autorun.ATA_virussign.com_e9b10daab93116235f71a3d4cba53b38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d240d3ae-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096053, "uuid": "792060c9-4abb-43d4-bda6-c436842e7acc", "comment": "Malware payload", "value": "5a02187b8aecda2259b288c94ffa0f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096053, "uuid": "e75034ec-d493-4312-b0c8-2514d1aa1b8b", "comment": "Malware payload", "value": "c2f1c6208e95a0127b52773a4659cc34e7d9ba994e3acc8bacc68dbeab5a1913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096053, "uuid": "d3fa0b6d-7b62-4538-846a-e52007ecb854", "comment": "Malware payload", "value": "218123725296b617867e38abb03c8d509dbc9129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096053, "uuid": "3532514d-dd81-41a8-ad72-05bb8c070bb0", "comment": "Malware payload", "value": "d1bde2b763513a6216edbb8496d1c42ecfba1e9bd6e8b084cefb27276041289ae43ca4b2a974ba8bbe47ed55347b2975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096053, "uuid": "92c34ab8-729e-4fe8-9eaa-7218030e5027", "value": "T11D748D1373A4D5BBE1FE173AE03206054BB0EA4BB616E3CB5A5C55B92D133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096053, "uuid": "57684e63-c2e1-4705-8a57-7e8d15d551ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096053, "uuid": "af225ea7-c6f4-40a8-867d-4d05065d6061", "value": "6144:67qQ4i1FFiEK5h+2o4d6nnEOXbILMktf7eLFgKDSwQG:8pliS2HZOcAY7aFNDQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096053, "uuid": "04fd3af0-5139-4076-af4a-e52bcea17041", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096053, "uuid": "e8749626-bd5f-4369-9fa8-6702b205ee98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096053, "uuid": "b3aadc51-696d-42b5-bcac-d34aa5471711", "value": "decode_f089a28e9b1b023281d26dd261b4f7e59503dbf835d12b75ca05f88122529568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef97c3c-4dce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694125978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125978, "uuid": "74d3b36e-01d0-49bf-bdb1-7aeee8f828dd", "comment": "Malware payload (Smoke Loader)", "value": "8be2e5736c169da874ad834678e50099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125978, "uuid": "fca8b90b-35b6-4fbc-bbc1-524550a2b5f5", "comment": "Malware payload (Smoke Loader)", "value": "c32d1a85c36bbd64710315de0eaa5a1cba81e0c2cabc9066dcc9d6abedfae432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125978, "uuid": "b3598c81-2d4d-44e1-8666-181865ba10d1", "comment": "Malware payload (Smoke Loader)", "value": "3315dcd9140f209305decfdce43697ef66b9b526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694125978, "uuid": "ae46e98d-d26f-4582-85e1-f45a063f9065", "comment": "Malware payload (Smoke Loader)", "value": "56a8e84d0365347aca9caa0b45c4b2540f23e197cef75b3275d1eea60b6ce4f0731b2a39a899984e712c0ef7ed68759b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125978, "uuid": "e29ca6ac-7173-42ed-b1ad-623b1203ce34", "value": "T107645C13A2A16861E51756718E2EC2E86A1EF8E04F5577EB335CAAFF0F701E1C672311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125978, "uuid": "61f54c18-d28b-4ec0-a819-930e10c9f74a", "value": "badfd3002a7785754765042ffe6b2bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125978, "uuid": "acb230cf-da13-458b-95a1-18b9675dca05", "value": "6144:ioO+HOdgoXCby+i1gR2AU/Ikkr5gHDc653y:RLsC1ogoNAkktgHDcE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694125978, "uuid": "93435ac6-6209-4fbe-bd6c-a9b402cfe828", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694125978, "uuid": "b8a3eb82-f8e4-4c00-b74b-00881bedd41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694125978, "uuid": "68aca7a4-256b-4d63-a955-2c0ba12544d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef37572a-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119294, "uuid": "a129c91e-ccc8-48bd-8c6b-77badf0ea45d", "comment": "Malware payload (Mirai)", "value": "c18695a4966c5c96791b19210bf28d15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119294, "uuid": "995bcd6c-a566-434f-bae8-04010d4c42fb", "comment": "Malware payload (Mirai)", "value": "c3e15edb8bd36796b45e2c34a19720d36301a84bd0e1cc70d97a0c150e916525", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119294, "uuid": "2fd90f11-b3a5-48dd-8734-b5c0fe8b7091", "comment": "Malware payload (Mirai)", "value": "7f33feb4da0656ae0c9a0c147f34b29b48480181", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119294, "uuid": "65bdc224-f3eb-4b9d-9420-51683f387d0f", "comment": "Malware payload (Mirai)", "value": "d7a99faabbcb14d4b07412201eaf082ed7a01ae9e29c2ba64acb502b66a33c9cf845ba428921ff872c4b816dcfb457ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119294, "uuid": "17b02c0f-0e6c-46cc-bbf0-33b7bdbc3731", "value": "T176B2C0CC61543084C98D7C7C178D4B664FACA1D0BAEE8B15E350CDA8B3BEA8F7459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119294, "uuid": "b05dceef-2261-4795-8059-c6635d6bf6d5", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpuZqSWvu:4QlS07FUXqIYSXQKquiqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119294, "uuid": "196af582-5823-44b1-a4e6-7c531153f1fe", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119294, "uuid": "046e7d75-86af-49ef-9f24-e35a713e9ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119294, "uuid": "7b540554-99b3-4059-8c03-7c3e16be9383", "value": "c18695a4966c5c96791b19210bf28d15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fe638c-4d90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694099257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099257, "uuid": "6e9633b6-9bfa-4d07-8b37-404746e505cb", "comment": "Malware payload", "value": "f306968c85745ca275dd343997ce4556", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099257, "uuid": "6d33eef9-6a1b-40d7-900b-c25944a08dea", "comment": "Malware payload", "value": "c43490f373bf32401ffe2d9355865db093fd9b1393f9732a8a5827e5fc0c4fe7", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099257, "uuid": "fe99bf38-9008-40b1-9fe7-ba4a557c3314", "comment": "Malware payload", "value": "eb6245329bb41e4ef5bf4d478166cadb4229c97f", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694099257, "uuid": "8ad01c28-1da5-47b0-882d-f5cfe6d6c913", "comment": "Malware payload", "value": "525003cf7e15f785329edbc405acd3d62620dfdc774735f1e4f6c9144beacf2d4decb02f8e60caf9fe15e5df769a1a7f", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099257, "uuid": "5b82193b-189e-4b3a-9ccf-1a9054899c1c", "value": "T1AF65AA342D79BC2447D7EE6336F00A550DE446AFE0303A3B1A8ED5668A7A2D115B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099257, "uuid": "d6248518-cfed-4a04-8194-fe5180dc709c", "value": "6144:j588wHx9kuvpxHtcFOhDzNuiI6URMX1zxHFiqWtEKwGhqfn:wfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694099257, "uuid": "56b47a6c-542d-4baf-b9df-6086a167d0d7", "value": 1424291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694099257, "uuid": "0193d153-c931-45e9-918d-4d98139b7cdd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694099257, "uuid": "4c46e8b1-c405-4890-b186-2b4fb5bf49ad", "value": "Client version(updater).hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0f7cea-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081418, "uuid": "ba48d3e4-6225-41fe-8ec9-aa95f40b27a4", "comment": "Malware payload", "value": "4a5e4ce70ee3ad1d18398b1a985b7e46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081418, "uuid": "edd69548-f316-4b63-aebb-e99cbb3bf5d5", "comment": "Malware payload", "value": "c44483767956f11fb4ac4fdf981ba3b92fc70b882c181d159144432ccc421c4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081418, "uuid": "db3ab5bc-b1cd-474d-96b2-c6784455a53d", "comment": "Malware payload", "value": "68539a32b7c642c71e6e841cab5dd09ab7ce87b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081418, "uuid": "25b4b3ef-0e2d-4901-8db2-5a15c21fc9d9", "comment": "Malware payload", "value": "3e4a22399db9bb31c288062d89bf6b3491aa903efc88f736ef073ec24d9e996898f825c801374ae250451740f47f6db2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081418, "uuid": "2b02cd03-89c5-4205-ba02-6cea6859dc60", "value": "T16FD33A83B2A100FBE876C23986535E45B7BAF41103B0ABBF0755495D4F537E0AD39BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081418, "uuid": "0c76f9dc-1122-4dd4-998e-5cb21c2424ee", "value": "8b612057bcdde43ac571ef7afe644f02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081418, "uuid": "580652ff-2a56-454b-9b5b-a712690ae42f", "value": "3072:Wpq+8MhHRIK8k4B7KHpwRXDYNdY2vML5K9:G/L8hgpwZY79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081418, "uuid": "ff1e332f-6260-4f6e-a58a-4d22c505a53b", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081418, "uuid": "fcb759dd-9ccc-4117-89c2-1699d1172c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081418, "uuid": "2bb9ff38-df2d-499a-ad6b-05c46c26e1e1", "value": "DLL101.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73018b78-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694069264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069264, "uuid": "2dd2fd3f-70e2-4ca0-978c-93036c132804", "comment": "Malware payload (Formbook)", "value": "c8826acdd501ef48ed35c5a03b142050", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069264, "uuid": "a394c2a4-44bb-4654-acfe-e3bedc33c49b", "comment": "Malware payload (Formbook)", "value": "c554b0418500c3655e3ebf9fc7626fbbc146d0d7fee74093c97e05c0ebda16dd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069264, "uuid": "87e9548e-5da5-45a7-bc02-bbab0dc2bfd6", "comment": "Malware payload (Formbook)", "value": "5ea272632c983e7dc3bc01f449549f0b8bb40857", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069264, "uuid": "d4de9353-9412-4fb2-bd23-e1040b9fd242", "comment": "Malware payload (Formbook)", "value": "ddfb89c88becf7228598ea2ca5be835559a93cdda5752af72b07cbc8cd1a7ca88adef7ff2c6b22d37e766d9d54401d3c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069264, "uuid": "25e9e8ab-0819-44da-b34f-69e732cd43cc", "value": "T154D4238C96F2CDB2DCEF56365A662481E672FBD8252F0951CC14770439DE2CAB288937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069264, "uuid": "786c3c50-e640-4c34-9266-0dd1d832d8a3", "value": "12288:lJNmcfrUJtctam8q4puRI0KQoQ87oWBZX0cSp4j5GXNnQ57CnvKl:TnUwT4sRI0KQ58BZ+p4+xnCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069264, "uuid": "589f5d22-e3a1-4ead-b6b8-88887b34a6e4", "value": 641290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069264, "uuid": "6938a400-b756-4ebc-bcc6-92f06628e3a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069264, "uuid": "74541f8e-612a-4e23-8af4-a9ee5480a56f", "value": "specification quote.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6e4f37-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075563, "uuid": "171ccfa9-57de-4de2-89cc-5cb628e24676", "comment": "Malware payload (ConnectWise)", "value": "9de0ae284110e66b4fc0b79cc4ba2e3f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075563, "uuid": "1c963b74-0cda-4647-bf9e-55e9eeb9aee3", "comment": "Malware payload (ConnectWise)", "value": "c59d8e42fdb1815226f60a4989aef512fd535ecf10131c6c87a6b7db02c53bc2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075563, "uuid": "51ab01f3-d490-4a94-a1af-e75d18e51ab5", "comment": "Malware payload (ConnectWise)", "value": "afd9204856799ada06d879721f088a4d93af38ae", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075563, "uuid": "e9fc9335-b353-46b0-9852-81b1fa0c3307", "comment": "Malware payload (ConnectWise)", "value": "739a2b6309079d7a234a805fbb1b584f53a0c0211e02f17799ee92c53438155014b64dad9f9fe41f63ca352260aa9b2c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075563, "uuid": "4dded4d3-385c-4992-b148-c322354b9eb8", "value": "T197836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075563, "uuid": "07b218d3-70c2-40c7-b4fd-39ea209fad30", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075563, "uuid": "ed3c1627-616b-49a5-89bc-cf51981755d1", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx32k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx32k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075563, "uuid": "b83969bc-e95d-48a1-a583-09a80a530c00", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075563, "uuid": "7e90189e-55f1-45f6-9aa4-e151c3ef14e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075563, "uuid": "0508dcc2-65a8-49d9-bd19-572790538a33", "value": "9de0ae284110e66b4fc0b79cc4ba2e3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0bc229-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694092523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092523, "uuid": "bbcca525-f24f-4bd9-84c6-6727f9ac5863", "comment": "Malware payload (AgentTesla)", "value": "2bc409652c297015ddaa09b721324ac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092523, "uuid": "87a0a980-a92c-48ed-a2b5-484bee707356", "comment": "Malware payload (AgentTesla)", "value": "c5b726402d9ab379a66d4cc3236f971edc3eb16951d0999ffc5b7b117714543b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092523, "uuid": "e9891f28-ed5a-48d0-af7d-d2fbff49d083", "comment": "Malware payload (AgentTesla)", "value": "1238453f1cd2822953b288bcd96c7547154536b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092523, "uuid": "527c8bb6-5b8d-4c96-92e6-0318bc0abf28", "comment": "Malware payload (AgentTesla)", "value": "7c9619fdfa5ed5ef3ea8abf71ca68b42397c5bc1b9a2bbe4e8d6757bae05fafd3627b75fc56d3c723c5fbf38a8f61115", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092523, "uuid": "5901ddf4-389f-4b9d-8378-8715fc7d91da", "value": "T16E3400077E44EB55D6583D3BC2EF2C1817F2A0C71673960BAF58AE616941293BC6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092523, "uuid": "64c7caa8-9530-4232-9379-a17fcd458934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092523, "uuid": "04550406-ba2c-46e8-8fe5-cf77886f9c0e", "value": "3072:fsRRJPHN75iyZ81ekzbLc+iplTKe2TxBk:URRJPHN7IyZ81eYM+4Ke4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092523, "uuid": "ceb52e80-921e-4a60-b00a-a0510550f2bc", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092523, "uuid": "ecce31cc-b7a9-40af-b7a4-ab33585597de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092523, "uuid": "d97a5549-94d6-4f5a-b347-a0ef38ab72ac", "value": "c5b726402d9ab379a66d4cc3236f971edc3eb16951d0999ffc5b7b117714543b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75f28ab-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694096061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096061, "uuid": "2cd9e7c3-a234-42fa-8b57-1bb0ae2ff276", "comment": "Malware payload (AsyncRAT)", "value": "e6abd4b1d3df74ac6eee1024511ad754", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096061, "uuid": "ce4dbdc8-a629-4a19-977f-dc05b30e0060", "comment": "Malware payload (AsyncRAT)", "value": "c639141e5f00157dab95ae4b272e46d0b9ca85b97a2592571b03d240ffafad57", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096061, "uuid": "12ca28bb-43d0-418e-be7a-78317ff83a5d", "comment": "Malware payload (AsyncRAT)", "value": "ab2effc3d87104778f59efa4292ce684646f04da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096061, "uuid": "df78c84e-c286-49d5-a754-84810c00b1a4", "comment": "Malware payload (AsyncRAT)", "value": "d4283155a137389f3c005d0bb56981f2adcda6f8806fc2954e0ee0bea39e66f3610b7841ede16bf282062b48ae9af593", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096061, "uuid": "4526f0ae-c11d-4e00-9382-9e768f127db7", "value": "T1B9236C4037E8C136E2BD4BB5ACF3A2418679D6675903CA5D6CC815EA2B13BC596032FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096061, "uuid": "3ea668f8-d4d6-4e6e-88ea-61531c68bf5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096061, "uuid": "106f6f39-ae2e-4360-a6d6-224efcc78f64", "value": "768:Eq+s3pUtDILNCCa+DiP9JKk81yI/4isl8Yblgeofbksg6V9uvEgK/JDZVc6KN:Eq+AGtQO1wjwBzbizDo6V9unkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096061, "uuid": "5f30c26f-8909-44d1-944c-849cde1e7597", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096061, "uuid": "722bb415-a2e4-4502-9f79-d762d4f8b544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096061, "uuid": "22ff1eec-4789-41bd-9e2e-375356d76d1b", "value": "decode_fbbb77be073f8a76fd67f68d562a78dd4e1efc65017a86e15d417a174379443b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56c9d4e-4d9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694104594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104594, "uuid": "4b89d398-183a-478e-9717-e4f3b44249c2", "comment": "Malware payload", "value": "8d3565dc442ecf46616287901d3f6616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104594, "uuid": "2ab13312-7b32-4c07-b134-b61bc2a17562", "comment": "Malware payload", "value": "c6b2216abd033f2921fb448f33e7041a43868b69de61c3722a2811f7754d1464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104594, "uuid": "fa8dcb7e-00c9-428c-9f77-d5ef66e99f5d", "comment": "Malware payload", "value": "c52ede9689efb5bbfd58ffe70cea86587c6a476e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104594, "uuid": "42584cb7-2fbb-4bb1-8330-1a7282f68274", "comment": "Malware payload", "value": "f278c7e04e8e5886a381f30d32b9c21872d622b17f519f827f9bbfc61974f5c91e3f4b1bbc37ba4ea75886ad5a228f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104594, "uuid": "a7a457a6-e765-4543-86cd-0d07f0c21466", "value": "T18C469D379E1D5CCDE90164719C1A8FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104594, "uuid": "5826821e-1ae9-4fc3-b816-23a3ab0351ae", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104594, "uuid": "326242a2-50b5-4697-816e-0cc29d68b2d3", "value": "98304:cSZ9WkDtVUsAdpxfVog5CNh5qTZaO2xdp+mgulfa2FMIRavYd96:coWkh2s8HVx5Cf588xdp+mgulfa2FMIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104594, "uuid": "fe2d17cc-fd35-4505-8f3d-50ada107ecbb", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104594, "uuid": "c66da21e-0d60-45b1-ab09-2a8131654137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104594, "uuid": "54ee9968-9aa3-4409-a57b-aa0482c3fe1f", "value": "SecuriteInfo.com.Trojan.Crypt.8612.18677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccc40c7-4d78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694088850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088850, "uuid": "6c993bca-dcee-40ab-b9cd-a54410b3ebfb", "comment": "Malware payload", "value": "e4584ca485a3be1cc9787e6367762138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088850, "uuid": "71601daa-757e-449b-8ed4-8c7415e4d12e", "comment": "Malware payload", "value": "c6e0f7995cbcf41d848ecc86631fd638aa53c44be546ecb3bfbb3ba331a915ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088850, "uuid": "2b8f1521-3bc1-47b4-9eb9-fb0d6059739c", "comment": "Malware payload", "value": "03694bc5018da52601848997c5b975c59a5674f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694088850, "uuid": "d5e3be70-d610-4037-ac7c-c747cace9abe", "comment": "Malware payload", "value": "25ca6cf521a618ffe1081df063364370bf5ebab956324192aa42df96bfe6f5c993af9b07e075ee81e5ef6da20bcd39ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088850, "uuid": "3c2e6d12-f8ea-4df6-9ea7-c84b9725ce03", "value": "T1CD04DF31827D45ECC0825D7B20441A3282EE194FDB299EF2BB59DFE26DDB601B3451DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088850, "uuid": "8b512776-b1de-44c2-8cb6-8c376c2b1804", "value": "ebf39a4c6044b27997487277e5b094b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088850, "uuid": "0a7cd816-3de9-4fb1-86e5-d6aec2f53f03", "value": "3072:DXqFflPGiRnFYea9pxttSZrsYJDs1qVXl6zmhoSk64TgG8ax9LjimrU2IG8uF+k:2FdPGIcpXMrpJA8bmSk6md8siiwGLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694088850, "uuid": "531cdf28-6361-4bc1-b283-d5c0d4a5555f", "value": 175664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694088850, "uuid": "aa32b489-a9ce-4a1b-8f21-41fecdc7ac4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694088850, "uuid": "5c251416-d184-4098-a2e7-993d3b86dd3f", "value": "c6e0f7995cbcf41d848ecc86631fd638aa53c44be546ecb3bfbb3ba331a915ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352120b5-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069160, "uuid": "05cbac23-f903-47d0-af0b-474e2712a83c", "comment": "Malware payload (AgentTesla)", "value": "c4d0d32ff98a62a437484edfdda3e795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069160, "uuid": "a55de08e-62b4-4784-98b6-72f5b0c757f7", "comment": "Malware payload (AgentTesla)", "value": "c70653b62d36bc066f5b9253d3a9f519eca5ff2d58fd39affa1d0e2468186980", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069160, "uuid": "60174ba9-91ea-4a82-86a1-2e26e30e59bf", "comment": "Malware payload (AgentTesla)", "value": "2cb618c2ea233141e576f8acf8008fbd51de3a4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069160, "uuid": "7e2fa8c5-2b03-4e97-a89a-fc129fd4d858", "comment": "Malware payload (AgentTesla)", "value": "c157fd43b7475f9a47a3cc9ed744f2fa00c8214ecfe27e9db60263c345335c81e5da28f9fef6f2820078e00eb059cbdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069160, "uuid": "9c2516f4-b019-4ccc-8fa7-68b23801db43", "value": "T1A7C412B353F0EEE3D7AFAF3E159D8616DA1E58135261F0299008479105C1E6C4FABEB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069160, "uuid": "1c877160-0a41-414e-bf59-b3e17ae808f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069160, "uuid": "6023ba13-f287-4bb8-8b56-d0962ad9460a", "value": "12288:j5HUnof9InnFYr28NP7QAi0fBwEq4sgp+peQQ5Z6vcIXMh:F0mIFWb3pm4rQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069160, "uuid": "a9a04d47-dadf-45d1-8e9b-3cb48752f280", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069160, "uuid": "41e4aff9-aedb-40b5-afd7-1819a6848bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069160, "uuid": "85ee06e5-2725-4fbc-8c5d-24310b218e13", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8257d9-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694075187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075187, "uuid": "812e7e71-34ea-4c1d-a6ee-667b39c6cb27", "comment": "Malware payload", "value": "af43f40a0b114fd0dfc2919b475003ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075187, "uuid": "7b9678c2-a937-4057-9c83-5eda0d85a8c7", "comment": "Malware payload", "value": "c73c833cf19b73f077ffafe40b7eaa6ff867c08e633eafe2dec1b0d1e7c85d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075187, "uuid": "da4ac19f-d0ef-4c05-ab21-57a57f140456", "comment": "Malware payload", "value": "b7f90bf355230c39b95db92d131b93f336ef4d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075187, "uuid": "3a6c2604-f38d-42b9-a311-570f4cb3f6e5", "comment": "Malware payload", "value": "8fdbff7f49daf0c7086de65b0d2ebc1ad312a6675ea40dc5afe6e375c11b26667823b131ab8bd2c1b7fc789109f8ea92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075187, "uuid": "7d57d641-04e4-4446-bf8f-954d1e4fbbbb", "value": "T145C4127796A48F4CD17F9AB0751C7932DB2493E05EE3FB4A8653369E0AC2E1417E0B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075187, "uuid": "cb79ae10-d315-40b8-9b39-6aa8e3332a46", "value": "12288:wPEqMObeHM8yYPWG/RurFKmAAlTzn5x+c/IaHUItCtN2m7PHj:wPEo9gmxAyTznbP/HUKCtN2g/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075187, "uuid": "a4837887-c3b7-45bf-b418-e4151186ff35", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075187, "uuid": "8acf3af7-4ada-4114-9ec8-d88b62e7b755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075187, "uuid": "84697ae6-d688-4646-92ce-0d9cc26767ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b393910-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067909, "uuid": "3e9f16da-8d9d-482f-a47a-765094b249a6", "comment": "Malware payload (SnakeKeylogger)", "value": "70764b0be5af56de64be5623d1566a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067909, "uuid": "1a862de9-b934-41fb-a081-9c83a8ebb12f", "comment": "Malware payload (SnakeKeylogger)", "value": "c7c9747e107c823e94461ec0bb0c2dd3be694d8761f8599d6b3ae1ba3ef6a2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067909, "uuid": "8965538e-21c8-48ed-9b5c-25d544007e95", "comment": "Malware payload (SnakeKeylogger)", "value": "51953e880ae0680cce8652325686a54a7c2bba25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067909, "uuid": "4e7b3706-1413-4bf6-a6aa-7d651599905a", "comment": "Malware payload (SnakeKeylogger)", "value": "0d210c76b2f7f21a5f3fbc66f387fa2a9f97a321a32d90d3c0c7ee416143b18c404854e3d2e892ab9a23b715314a4baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067909, "uuid": "6738c51b-9142-49d2-9050-d9f62c219135", "value": "T11784C703BB96E9B1E2891737C696500433B4DA8273ABDB0B75CF2397A4833AEDD15507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067909, "uuid": "109a4a9a-aaad-47aa-98de-2ecc053f03b5", "value": "6144:1mRLFnJRtjcfkqYLv0OW9EnqkRwp5brMl+W3dvo1Y7LZAX:4JFnqforfRG5/jCXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067909, "uuid": "fd3d08d7-a043-41ed-8978-0965614770f7", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067909, "uuid": "ca5da00e-3dea-48d6-93c2-8ef2dfe21753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067909, "uuid": "194eb663-3c95-43a9-a8cc-abdd5a83e7cc", "value": "Apratkg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5380792-4d36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694060785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060785, "uuid": "ff1b2fd8-0a9f-4692-af37-64d29ee83544", "comment": "Malware payload (Amadey)", "value": "efb8ea72c16530c454f48ad968243bce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060785, "uuid": "bc521de0-1150-4b3e-9cbe-b21cfd863fc2", "comment": "Malware payload (Amadey)", "value": "c89ff819bff9f04c3c6ab67d3bb09b19464402903dbc3aa44283a6411736ebb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060785, "uuid": "639b5f5b-a0cf-4e62-aadb-f2b67e19f187", "comment": "Malware payload (Amadey)", "value": "8d867e15126544441328c4fa30bcc105feb35e47", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694060785, "uuid": "8840635b-f303-46b6-8bb3-1670817403af", "comment": "Malware payload (Amadey)", "value": "0f1ae6234f9109a01e2c190ca8f305770d8fced8a36392c821cc289c00cde8e71534827ed139d3c5141c68a243786662", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060785, "uuid": "e7c4cec3-9b9c-461d-a1a4-692034daa27f", "value": "T16424F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060785, "uuid": "c6f48e37-884a-41d8-8ffd-d69c9d7a2295", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060785, "uuid": "4ec91dbe-2b7f-4ba6-a711-4247d84655dc", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694060785, "uuid": "3cc7171b-87dd-423a-a7ab-2c6a3c5b76ec", "value": 225762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694060785, "uuid": "9567faaa-1a0b-4995-951d-bd9b8b11dab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694060785, "uuid": "2d2ff9e1-9746-4d84-b42d-e1bc317177a1", "value": "efb8ea72c16530c454f48ad968243bce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e71ccf-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084858, "uuid": "832f368c-4915-4958-bedf-08bcb952616d", "comment": "Malware payload", "value": "5bf4073231a7746fbc4821631decb4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084858, "uuid": "e9349e13-92f5-408e-a34b-44b3d818565b", "comment": "Malware payload", "value": "c9102acb6323c4f24b56ec7e32878b6865ba5b26b816d8febdf4b31eac5506f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084858, "uuid": "f4835ea9-6636-43e8-9a13-17d37844d5f8", "comment": "Malware payload", "value": "c2f9555056506bac22c825fa535c88d22fc301e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084858, "uuid": "f3c1c012-d390-4ca2-afc8-bccfb3a1bbe0", "comment": "Malware payload", "value": "50455f8224bdf61f16c9bf87425a50b8f363642bf18c460f7a7dce08e3eb99253b8a08c4ac7b4ae2d51624c814039d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084858, "uuid": "cf70b49d-1496-4bc0-b409-0e4ab01c8094", "value": "T106A48D2AF7C08837D3631A38CD5B8768E826BE503E2965463BF81D4C5F7938179263D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084858, "uuid": "ef35e06b-7af9-400b-9662-16289515e024", "value": "26496ab6355e75472c49cf2dc4f6cc6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084858, "uuid": "8e476fbc-5927-4b98-a39a-5f8d938825d8", "value": "6144:ddspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70NqI:z8kxNhOZElO5kkWjhD4AsYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084858, "uuid": "2deeaded-2b92-4447-8132-766c29154a92", "value": 481815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084858, "uuid": "edf4d1db-91c0-4647-9b52-a8c704b7d743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084858, "uuid": "e316ddd1-66e4-4b08-85a4-7e124dfbf274", "value": "Trojan.Autorun.ATA_virussign.com_5bf4073231a7746fbc4821631decb4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffe95d1-4d80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694092452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092452, "uuid": "d8c15fd1-1d73-45f1-bea9-5612afdbcbca", "comment": "Malware payload (DarkCloud)", "value": "d759ad7285af8aabcbf6517b391eef3a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092452, "uuid": "4e305de7-fbb2-4004-b973-5831329ed130", "comment": "Malware payload (DarkCloud)", "value": "c9593d350423e3ce5ca038658574d32f9e9e99445ee0bf59c5f44cacdfda0906", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092452, "uuid": "53ab45d8-0da5-4967-8bce-424595c1fc38", "comment": "Malware payload (DarkCloud)", "value": "670a00a9d1a0fff540ca5aa6d90d5d8ede6b66a8", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694092452, "uuid": "8d2c2791-943e-45c7-a1f0-14f38050d370", "comment": "Malware payload (DarkCloud)", "value": "7fccece3ffeb5c9f9282b02f7bc3ffb32d52db23422ea9352065dafdca1be65752fc5945a114ba6ce267096ef721eef5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092452, "uuid": "bcd3c46b-1ceb-483f-946f-f6731535b19a", "value": "T1E5A42A1BE711A02EF192C5B0EAD452A768152EB72298EC57FB816F4832355D3E8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092452, "uuid": "3f23d1b1-554f-4286-8351-0db982bbe52e", "value": "e1f594e59f684b51e1a504fb3c3b8636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092452, "uuid": "94fed010-c6ed-4dff-b580-9ebbe675a976", "value": "12288:B2tFZW4yzH9utcgyWDXZIuzLMAxU3hPsjYKkJj6GmZU:m2HOGuvMAWMYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694092452, "uuid": "3e252515-b8c5-4c16-851a-e012b3f16665", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694092452, "uuid": "cac369a6-79ee-451b-b355-2bdd9dd5c55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694092452, "uuid": "12931aba-4c17-411a-9dff-a151e1287666", "value": "c9593d350423e3ce5ca038658574d32f9e9e99445ee0bf59c5f44cacdfda0906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab71c04b-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103289, "uuid": "7a9038e2-c3f9-411e-a499-6f48515b2966", "comment": "Malware payload", "value": "24394038cf7124deb092d49a060c707e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103289, "uuid": "fe0df2fb-7b43-444c-8bcd-cff7e6e25c45", "comment": "Malware payload", "value": "c9d87f42852b7c188b42b147e4422d158271ee647294112981a5fc9f6d848bda", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103289, "uuid": "6965c7d6-f781-4451-bda7-36128fb486ae", "comment": "Malware payload", "value": "058d306b1c8f41bfbecbba39845d3cda6c546099", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103289, "uuid": "0ec36eae-68b8-4ec5-863d-b9578b7f4e7e", "comment": "Malware payload", "value": "14aee130ceadd8ba1f74f0957e648f33a22fe5b004ba6043f41fbe08a16677a85674ba1f9e92c8741ee94cd58c0346a4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103289, "uuid": "761acf5d-422b-487a-86e3-d0519a86eff6", "value": "T14AE423868E39998F9FE063220BD48F01E8F553EC36AD2D6C450792C19D37958D2BAC1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103289, "uuid": "69677b1a-0d4c-40ae-a82c-81ceacb68842", "value": "12288:gjdLUtsMgRS+t6HyNOra2aTi0o7E5CsJ0dTLul2KwXuTl6nwmwVxEVzB:gqCA+k1kTz59GhLubWuTl6nlws5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103289, "uuid": "7ada6157-a6a0-4ea6-83de-d36c31292b8c", "value": 702597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103289, "uuid": "145e969d-3b14-430b-82bf-88dca0b04b42", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103289, "uuid": "009a0a21-3831-4af9-baf8-10e7611409b1", "value": "cotizaci\u00f3n00937928.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ace2bc-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694081402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081402, "uuid": "dbc325a0-d7b2-4f22-9e4f-a1b9df83bbb6", "comment": "Malware payload (AgentTesla)", "value": "117fd2311411e68670938fe65ad045fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081402, "uuid": "47abe813-3b93-48d2-b566-8a52620cd706", "comment": "Malware payload (AgentTesla)", "value": "ca717a839eb9ef1e0a9029cbc232a54cebaab99ebe8f4c467297d37ac09c512e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081402, "uuid": "8d11af7e-4e49-4b1c-b3c4-97024a7f4238", "comment": "Malware payload (AgentTesla)", "value": "12e501d52f4bfbec5da182b2b989fb05fff60ae2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081402, "uuid": "73409ba7-9310-4f49-8d06-2e495542589c", "comment": "Malware payload (AgentTesla)", "value": "5d7163d4bd8ab023605a13b727dad6c83389911b5b49091c07b595d7e9f2b4c18a8a2ccdd026e082ffa063f188acf403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081402, "uuid": "c99a461b-29d8-4663-899d-0191a7902452", "value": "T19FD423540DA9AA2FD84F3FF66001A2F5816392DA2016EAD70C0FF4DB6B1075F8942F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081402, "uuid": "82f6826e-7c9c-4ddb-a952-bd65d4329133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081402, "uuid": "755d7511-51a9-472e-9807-c30ee89a754c", "value": "12288:MgmAY2kcdbL4EfBI2I2MzZkq6HqMJkVSlOACPoCD/Dp5Hs3Kp30PHyLXZog:8N6GEf9IpZbCkVSs5bt5HMoJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081402, "uuid": "bbbbc00f-8ec8-48d0-9128-a68e524596ec", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081402, "uuid": "948f46e6-d902-436a-a5a0-2caab09dd02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081402, "uuid": "3ec2aeaa-c825-46fd-96fc-ad240527acd6", "value": "ca717a839eb9ef1e0a9029cbc232a54cebaab99ebe8f4c467297d37ac09c512e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4edaf6-4d1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694049385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049385, "uuid": "139f792c-a08e-40dd-bac7-9e0bfe3fa94f", "comment": "Malware payload (RedLineStealer)", "value": "8ce8bdaab89d2d96148ff0d59154e657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049385, "uuid": "62d51a67-c085-452f-a6a2-c46392387db8", "comment": "Malware payload (RedLineStealer)", "value": "caafdab48a01ff38959edee69d401c750bb0a92fa113b535dc05a2f2fbb59909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049385, "uuid": "4ceca4c9-1f94-49db-af3b-ec5b949d8aa7", "comment": "Malware payload (RedLineStealer)", "value": "e770d3ba7a482255fb27e497ccbddf5077d68ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694049385, "uuid": "51d5243d-72d7-465e-90c7-1d2257dff973", "comment": "Malware payload (RedLineStealer)", "value": "96b89e706b56ceff181643720df62cdd9ca96a92ff108ccf54742209046df1a06f917b0f43bf28f96276e99e92bdc5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049385, "uuid": "5ecb3b7a-ab9b-4e7b-a9e1-61c3332a8d67", "value": "T148E4120B97D85132F9F567B02CF607830A32BC619D7853672A45A89A0CB36D4F93937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049385, "uuid": "1fa81756-ea82-4824-92ba-a23d08e8b806", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049385, "uuid": "4cf00656-592a-4f0a-9cdb-26cb126a8c8f", "value": "12288:uMr7y90HWZ2vYvhVEG3CNU0qTE3MOmjTGaQmSYC6z1ALVWrAsT4cu:py1Zk6XE+CVHMpTGVwCq1yu4cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694049385, "uuid": "d714e25a-8531-4ca1-af75-9bcb362387cf", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694049385, "uuid": "aaede986-5163-4efb-994b-bb73d01938ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694049385, "uuid": "22c1948d-f705-415f-8210-c54f8f30b158", "value": "8ce8bdaab89d2d96148ff0d59154e657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfab939c-4d9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1694103753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103753, "uuid": "820b200e-3b27-4bad-94c3-b34c22b54bad", "comment": "Malware payload (Vidar)", "value": "071793a0b7b0885876632fa96fd95500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103753, "uuid": "71e77523-56e3-411e-aa19-4b106820abc8", "comment": "Malware payload (Vidar)", "value": "cb0622ed5e4fe421c32b253180f14e4893f8ae0c7b48e75a49a21a2c64234bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103753, "uuid": "ec0a20c9-eae3-408c-8883-fdbc2cda20c3", "comment": "Malware payload (Vidar)", "value": "cd95f46c27ecbb1c60c9ea6fabc83af8738118a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103753, "uuid": "9edac80b-088f-4673-b39a-e590594ad5ac", "comment": "Malware payload (Vidar)", "value": "296425fcfbd4f13b430360643cb31eb7adf18fbb060e140ea73aecc7c0d09fb90c5d3b04f9eab9ff49c583eb3b6ec2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103753, "uuid": "dc108ef5-bd45-4941-a8d9-b751375e43e5", "value": "T130848E3292E16872E6234631CE2AC6E42A1EF8E14F547AEB13549AFF0D741F1C57E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103753, "uuid": "5b3eb58d-63cb-407d-ae55-f3c7ef1c86ec", "value": "b890c40ce8bcf6bf76e64f737678ffbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103753, "uuid": "a69ea698-285e-4e10-881a-d8b5665e47ed", "value": "6144:O6tpPJ4xhX9bOjNsLmPdCpqPgz6qYvnHu/E5YzJi:Os74x5lWNemFCpqP8YvH0EW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103753, "uuid": "c116c5f1-680f-41a9-90b2-d76708c1d803", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103753, "uuid": "7d70cc00-609a-4590-ac04-df4a4cd19f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103753, "uuid": "48d793e9-1f93-41a8-b191-0b836d819710", "value": "071793a0b7b0885876632fa96fd95500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31623174-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094065, "uuid": "c9b92584-b16c-4238-ba25-c8554eee5889", "comment": "Malware payload (AgentTesla)", "value": "2c4dffe9ada01a0d18a13ba214821897", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094065, "uuid": "b1e5ca4b-0239-4b9f-a043-f801cf73a70b", "comment": "Malware payload (AgentTesla)", "value": "cb2f1dc8a293bcdc724d776948feb47289896b1ea76bda4500de1483383279d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094065, "uuid": "d928164d-6854-419c-a035-d34de2ad6f7a", "comment": "Malware payload (AgentTesla)", "value": "cf75984993f41babe256d3ea0863c64108ad716d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094065, "uuid": "045fed47-c66b-4c98-bdf0-b42c1fc89afa", "comment": "Malware payload (AgentTesla)", "value": "f3ed141e8ae879d92b2a9c8344de20b69e377db5555125086b02c6763defde80345661fc03e6c8036ea32278577d04df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094065, "uuid": "66220d57-3d31-4d7a-bc5f-14456b794364", "value": "T174340F177E05EB55E6693D3BC2DF2C2413F1A0C70673960BAF48AE6169412837DAE32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094065, "uuid": "f38bbde5-247e-4910-b8e7-2114fcad623c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094065, "uuid": "6810c069-1fc8-427e-bef1-d02ca2a303d6", "value": "3072:4E32TUbUmxu+6yEdnDOCcW5hNz7XoDo7xcQqaH:eUo2l6yEdnDOCcMXYDodu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094065, "uuid": "66a956e2-0ba2-4770-a343-57fd69d03768", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094065, "uuid": "fbd9a37a-a9b5-4b56-8c7c-fe8a4546647d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094065, "uuid": "ba7ad10d-710a-41f1-a1ff-92a4809856ae", "value": "cb2f1dc8a293bcdc724d776948feb47289896b1ea76bda4500de1483383279d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ba4c6b-4d6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694082902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082902, "uuid": "25eaac59-d149-4f25-a3f4-bc339e991592", "comment": "Malware payload (AveMariaRAT)", "value": "cad001180f03c7bd1290b4f595598484", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082902, "uuid": "57c28801-c500-448d-8781-f933cf8d8372", "comment": "Malware payload (AveMariaRAT)", "value": "cc0f8060db4621f80c89f6fcaecac1e626eff63478f63827deaba17077493edf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082902, "uuid": "ee768fe7-3949-4b2b-81cc-485b2591063d", "comment": "Malware payload (AveMariaRAT)", "value": "2b892eb79e551faf070c254c8aab3acb8df09def", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082902, "uuid": "38daf515-bb94-4b16-b802-5c89c49a9e7d", "comment": "Malware payload (AveMariaRAT)", "value": "d44117b545ac257b211a77dea6bf8eab4e37fc2e174ade5b2ceab884fb53dd8097cca3109d2d4ebe32630109b8fcdecd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082902, "uuid": "6a64f985-764a-4a0c-ba69-48a0c0208764", "value": "T19D35E0063388CF21C52F15B5C8A3C2F91717BE01CD449BD772C5FE2E79B22A9A9A1587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082902, "uuid": "a6f21252-7175-48a1-a1a8-13e2489c50d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082902, "uuid": "1c519290-b834-4f89-a81d-69ce8915be25", "value": "12288:s+NwTxLgz0MzvuCcxBx3CeHmEYa2OhvXlOw+ZyAZpqVEOFK9grVWwqMEt839Uke2:s+agAlB15Hmpa3f0JTZpqt0grVD1Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082902, "uuid": "6b25cc6c-7a18-4da3-8bd8-2360507c6283", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082902, "uuid": "bf3b1e2e-32ee-445d-b367-3a754da0882f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082902, "uuid": "133c2b67-8181-4d2c-8fac-93d05e9434d4", "value": "cc0f8060db4621f80c89f6fcaecac1e626eff63478f63827deaba17077493edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a2759a-4d46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694067437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067437, "uuid": "35c5e3f8-4644-4c8b-b0ae-ffa73252f535", "comment": "Malware payload (Stealc)", "value": "ae3d95d1f9678dcc1f3b2c6f91b111cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067437, "uuid": "eab513bc-2af2-4caf-aa31-535ab6c0495e", "comment": "Malware payload (Stealc)", "value": "cc6b425363d36d3d74b95da4abce17f161a6bb86eec01902059afcb05fe9d108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067437, "uuid": "738cee7e-28c4-4b98-9a51-c317cdefad2c", "comment": "Malware payload (Stealc)", "value": "943cdda5a7ef265ada4602887d6de2df3eca9cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067437, "uuid": "d1f96e4e-c949-48ca-b45a-3d267652f6b1", "comment": "Malware payload (Stealc)", "value": "05ede173e67707199977f4b3e5ed310bbb1e025c02c9522d39e27999785ae479c3b0037d20257f77fce9d655ff4740cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067437, "uuid": "0045cfc3-f6d4-434f-ac7f-7a593f111268", "value": "T1AFB3D600E940542EE1AA00FFA9AE5BEBE45C7E741381D0C3FBB16D7929E01F564B156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067437, "uuid": "d6f0a4c7-528b-496f-b38f-6e5a26a08fa3", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067437, "uuid": "8efdc4b3-622d-4987-83de-2b17dfc3f99a", "value": "1536:u7KHVrt+8nrvLSzFjCYRNLq0WQUeLnULJZZSv6hSwhxtb4UUSjCYebqHfdravR51:4KHVx70VLainUDQ6l4UUSGbYYzIelBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067437, "uuid": "8523b7ad-3572-4a70-9fcc-f1e74cfb37d2", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067437, "uuid": "7ccb2e7b-71b9-4206-b326-3dbcd0522a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067437, "uuid": "22e3571f-6b49-4f95-bb77-7df107b565d4", "value": "ae3d95d1f9678dcc1f3b2c6f91b111cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cc7baf-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694085071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085071, "uuid": "eff591e4-53f7-41e0-846d-fc29f01e0129", "comment": "Malware payload (Cosmu)", "value": "ea951884fc81304188630e9c08c4396e", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085071, "uuid": "ca6b1bc0-bbfa-438c-8226-11b42192e741", "comment": "Malware payload (Cosmu)", "value": "cc75f0bde8af959a1ffcafc15ce3a04d21a7dd71fb0d2ebc28ab5f314f304d1f", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085071, "uuid": "47ba8be9-fec2-46a5-a896-61c14e22ae60", "comment": "Malware payload (Cosmu)", "value": "cbb7a82ea7f54d9bc24f7304a891d9c2ac4cf637", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085071, "uuid": "e513c83e-5591-42eb-bbfc-c85807ad5ae2", "comment": "Malware payload (Cosmu)", "value": "8352742b4c2f14bf2e9de81a4644df00542a87a41d9d6f7ee5c34616eeaccf083178c3961db59bce91d89e4e80319377", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085071, "uuid": "393d5a47-9ff0-493b-8840-b6656aecafeb", "value": "T13864D0D13992C6B1D2F14DBE44B6AE518336AD036A20C593B39D396F1EB32DC1A9710B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085071, "uuid": "b5e106ae-49f8-4148-bfbc-fd2c8a6fd165", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085071, "uuid": "92a791dc-3e79-48cc-8e5c-c7ded2414c2c", "value": "3072:eQXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBW8wJ3PG:z9lKgzelZNQSBQGH/CSpWqT48Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085071, "uuid": "a0cec02b-370a-4e2e-84ef-46a6ad52d63c", "value": 333166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085071, "uuid": "35bf588c-c165-4512-b067-781e376fa736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085071, "uuid": "8847e061-8afb-4f65-a9ce-d86d68282084", "value": "Virus.Sysbot.ATA_virussign.com_ea951884fc81304188630e9c08c4396e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7702e5f7-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694085162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085162, "uuid": "e1d2c9a5-06f6-418b-9329-0c4b56ee4a93", "comment": "Malware payload (Cosmu)", "value": "287cc5974a1a9a3d228ca337108798b2", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085162, "uuid": "9d27cbe2-de3e-4424-9960-d6eb195b7a0c", "comment": "Malware payload (Cosmu)", "value": "cc8d6f9020063a8e28428fee1148d0e93809a15534f57f72207b26c98925ce5e", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085162, "uuid": "e77026d1-1fa0-4c77-8f56-5889adc2ad13", "comment": "Malware payload (Cosmu)", "value": "22bcc5127b976bdba581b1be1ede0f65b5702c8b", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085162, "uuid": "ae51b820-d431-49f7-a085-cd1d0caa6afb", "comment": "Malware payload (Cosmu)", "value": "f84fba48ecffaa1604e5f677d3cdc605cebea15fb105ed413485b68c10bffebb4580764c186d0d45a9b7b54aee4d6f89", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085162, "uuid": "1f199f20-30be-44ce-9c8b-c459bfffce34", "value": "T13694F14179B1DCB3C486463688A6CEE58733BE578935C1C7FBA9DF4F6E722908632241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085162, "uuid": "611470a6-606c-41d6-9dfd-7d7dd9352886", "value": "b6096454c0b0666c7e487d2e3e0cbf92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085162, "uuid": "7baf81bb-5e13-4540-bbe8-49f772c9d436", "value": "6144:VWIlKgzelZNQSBQGH/CSpWqTSNs6+X7jINs6+X7j3:VgfBQGH6Sfr6+X/l6+X/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085162, "uuid": "ecf8a0d6-a5b9-41df-b9f9-025b1031777e", "value": 416229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085162, "uuid": "020a00d3-7047-4374-9f4b-2f925bfa8e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085162, "uuid": "c6cc00cc-493a-498f-8b31-cf168cd312a6", "value": "Virus.Sysbot.ATA_virussign.com_287cc5974a1a9a3d228ca337108798b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217eb4d5-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111648, "uuid": "f7cbf303-13ce-4d33-a53f-4e691e133bc0", "comment": "Malware payload (BumbleBee)", "value": "0d73a7a18577fa6c81d0ccbe6a92261e", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111648, "uuid": "f258a10a-b871-4392-960c-5c70c9ac2b95", "comment": "Malware payload (BumbleBee)", "value": "cc9d10b98fd094d95ce155a5815e039a3eb6f3545708564c09e27834dc3768ab", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111648, "uuid": "5cce3134-ca09-4a03-913d-766843103dd3", "comment": "Malware payload (BumbleBee)", "value": "50012f0552e00b6055e486ee0ec43fed9f76ef79", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111648, "uuid": "f5b08604-d0b7-4704-ab3b-ebfb2b480ead", "comment": "Malware payload (BumbleBee)", "value": "bd56caae9ab83adca6cb482c44b1d70a2ecbcaddcfea0edf5dde50e102e926350a9bc27c227788a26e382230f9b3ae02", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111648, "uuid": "66ff4b9d-3692-4f8c-9ade-43e296129993", "value": "T162D4C08FECA1FFFAC45D0176C88E06A956A3A2406F06093BA56D028532D3B4773E775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111648, "uuid": "84f6e0cc-fcfd-4648-b370-27a1d2d0b6e0", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111648, "uuid": "57c40056-a3cc-4d6d-9433-221e2707c684", "value": "12288:9rwVav5KOhU9lPu2OSTXbIdmRzAtI2mghQhyv2udR:9gahKOhU9tNXuXmgy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111648, "uuid": "8adc1ed4-6529-4e00-813c-af4495f932b9", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111648, "uuid": "2afb9675-2438-4bcb-88ef-6639a2e2fbe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111648, "uuid": "89adf5e9-1391-4c0f-b28d-aa184f694fde", "value": "9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d443348-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069255, "uuid": "503bf94f-7206-4cfb-924b-577155a6d108", "comment": "Malware payload (AgentTesla)", "value": "725085cdfd5ec606bda6a37793653db0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069255, "uuid": "4a244a16-29af-4abe-a732-36517940468f", "comment": "Malware payload (AgentTesla)", "value": "ccc10d84dff9f45eaf7d748078f78b04c419af03ae60fb42036c050dc93ac349", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069255, "uuid": "f7322612-8999-42a0-9bba-8bdb0550dc29", "comment": "Malware payload (AgentTesla)", "value": "600abbf7f381549f35aa323edb17c4d5ffd4b8f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069255, "uuid": "796be1e7-9f1b-4e47-a12b-5b5b9687433e", "comment": "Malware payload (AgentTesla)", "value": "f3299740ce9bf1f458f8965d0b758fad84ed500ad29ec440e0e53f65afddc2f740ea6bae4e4b251d6864e1af08e485fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069255, "uuid": "77eef2b3-7d01-4861-be67-43fbbf7a990b", "value": "T13EF4338896CA66979FD45077DE1644BECCD3B614824A4D013EE8AEC029DB93F4F31E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069255, "uuid": "3770c4a3-7f05-41f3-9ba1-afa74423f734", "value": "12288:PJx38p0IIf/3sWQq8FvJlS1Btjpj60+xXtFLj1cOnRUVkbwdfKEmWh0:fO/icWQFFvJqBzj6ZtFLjaGSAwJKEmc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069255, "uuid": "320e0597-983b-403d-bb4d-a1499754c839", "value": 735969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069255, "uuid": "c9bbcdc2-a6e6-40bf-a2b9-ec58ffa73f83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069255, "uuid": "26af47fd-0770-49ca-9394-4d9f0676174e", "value": "solicitud de cotizaci\u00f3n.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a6b0c0-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084679, "uuid": "5df39cd7-e4e6-40b4-89c7-759f41cff1de", "comment": "Malware payload", "value": "0f6c7c6851ee7b27fa13c8ca4d7962db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084679, "uuid": "ef83310d-e064-4ec8-826b-3e886d8e34f7", "comment": "Malware payload", "value": "cd6e282159e4117dca53cf28d0c314364a2c739bd0c32173737ffb565e981bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084679, "uuid": "ce76f56f-db79-4b94-83a0-fe32190146b8", "comment": "Malware payload", "value": "6a68fa529d2844032dfd17a0edb9e2d33f8249ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084679, "uuid": "55d35b84-4d4d-4a92-99b1-6aa2fc7ef194", "comment": "Malware payload", "value": "7c5fb0613d8b34fabdafe0671c3b1dbe3f20d4c57a42838886a81f0d82126a182ad87647f6f30feb5bdd0ca76584bc55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084679, "uuid": "761d7320-285b-4243-bcbd-c3788fd48406", "value": "T1FFA47D2AF7C08837D2631A38CD5B9668EC26BE503E2965463FF81D4C4F7938179263D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084679, "uuid": "7f25b3c0-64af-407f-83db-51d25f6aebe5", "value": "143ce2a6a5d4393bd4c950cf26bac42a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084679, "uuid": "f2b13bfa-4299-4409-9f63-fd5885834e87", "value": "6144:XdspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70NqB:N8kxNhOZElO5kkWjhD4AN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084679, "uuid": "d5e2d983-4179-4a72-bd66-aaf943fcb01e", "value": 492466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084679, "uuid": "16452a88-905b-40a2-a31e-65d85ae195ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084679, "uuid": "b1fb7e0d-110a-4c32-9f42-b86652af66dc", "value": "Trojan.Autorun.ATA_virussign.com_0f6c7c6851ee7b27fa13c8ca4d7962db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b23661-4d65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694080783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080783, "uuid": "29965cdf-b018-44c4-a167-d70231dbf8ac", "comment": "Malware payload (Formbook)", "value": "649435d8f3f803abf5325a2b60a07fc4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080783, "uuid": "3a1d99c2-acd3-414b-89bd-47302ee53189", "comment": "Malware payload (Formbook)", "value": "cdbd808ab00449a102966c8e6443a4267ef6c70df08e711efa783e60e7ea3776", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080783, "uuid": "4a36b487-b374-4b70-abd3-f28630c418b0", "comment": "Malware payload (Formbook)", "value": "037f7bda8ee187ffe60dce789edca1c0455ecf17", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080783, "uuid": "63dcb618-8026-49fe-8213-5764d8baf9cd", "comment": "Malware payload (Formbook)", "value": "74449ad6c423c865360ae870f269c37ffba34a79ecbe6bb86316d4ffe50f01043759233673ead78d5e7f69f05701a861", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080783, "uuid": "d3690e08-2b0d-494e-a07b-d4985258a7ae", "value": "T15626332402B8494CF0B3763A9714BD6EA937DF8632A38857E1D671E54B50DC2DFC287A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080783, "uuid": "dceed17b-a522-49e0-821a-eedd1cd98447", "value": "98304:2UDLg++eOXZvJQUplADbggCXt1Lw4pkuYYaIDSINPi:2UDT+tJKxsd1LkuYJCRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080783, "uuid": "7f552f70-cd31-49fb-927d-5ae108e432ed", "value": 4613632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080783, "uuid": "ed4b9971-7cbf-4e85-ba55-7b2c51fe5646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080783, "uuid": "96603e9b-78aa-4197-ac44-a3131423396e", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b717ea0-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084633, "uuid": "ec7c3552-d346-4113-9eb9-0a43d073a03d", "comment": "Malware payload", "value": "0a2744f97b0fe32b0a3c4310c1d5fec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084633, "uuid": "99507836-f05e-4365-a5bf-699ec23ba627", "comment": "Malware payload", "value": "cdfedb51b2759f1aff8f45087d7484f5e7fc478dc7869faa4574bb760c76b59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084633, "uuid": "663da03e-1fbd-4a39-a22c-3eef3ec08696", "comment": "Malware payload", "value": "4ef67ab50ac8a73e5324c6acb40151df8b83b757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084633, "uuid": "c9808034-e032-4bfc-9a01-8654bcd907ac", "comment": "Malware payload", "value": "0b251bb5464bbb1d987eb03dc30ff16a96947303ef252388d777b4cf864918a14c5a852c7ce2ae5e628d28c799ae3bb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084633, "uuid": "7c49a518-aa43-40a9-a1d7-b70ff9298886", "value": "T1CB841240AB79DCE2F8510FF15B272B69079CC2D87EAC86309516EA37367E130DDA351A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084633, "uuid": "11cbf094-7983-436a-bdf8-537779de40f0", "value": "9a40b556f04c6c6d3d61394c56be6bd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084633, "uuid": "9f277957-b51f-4f16-b07b-b12b436206a7", "value": "6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084633, "uuid": "c6a5b81e-5de0-48b1-a40c-b16bf461c717", "value": 400379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084633, "uuid": "db72a509-a55b-4dea-b978-d3c3dd4699d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084633, "uuid": "059f1e72-5ef4-4881-9375-d0db8568a5e9", "value": "Trojan.Autorun.ATA_virussign.com_0a2744f97b0fe32b0a3c4310c1d5fec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eacd289-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103080, "uuid": "90d933c8-bb7c-4b67-b555-41e6afc4ec76", "comment": "Malware payload (Mirai)", "value": "a1874cc200d21270547ecdb5e393e179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103080, "uuid": "0d8a796d-acab-4b99-8d1f-14bb91040440", "comment": "Malware payload (Mirai)", "value": "ce72959a651c044f4982862b49a18b71349e6579e3fd1c2ce8d39333f411071b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103080, "uuid": "978b432f-040b-4d7b-9f55-9171167047ae", "comment": "Malware payload (Mirai)", "value": "dbde8c209c255687e04414993a3ee7cc242bc19f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103080, "uuid": "832bc6be-f7b9-4fa9-ac55-15ea67d7d63b", "comment": "Malware payload (Mirai)", "value": "5105c9ca81289fed1d9bc2fca18b9ad988f58934c80c5c8379ac2061f3e1fa47faf9d1bfc78d01fe4583bcb3ac71d573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103080, "uuid": "b7122c19-85ae-4e89-a8d4-6c95ea3daf69", "value": "T1E9D2E12CD55D7D06C6AD3DBE51CD56F5398CB080A35DA5CE17268448BA2BA4BFC0B0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103080, "uuid": "90e8496b-3a56-4c22-99f9-a74a36fbf750", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNnkteJbiWUo:1bDs06t4BEub4sU/MbUnBmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103080, "uuid": "acef0a84-3280-430c-944e-d16799882271", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103080, "uuid": "a7f4015b-ef53-4442-b8a2-d28bf0c0ed33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103080, "uuid": "90c599e4-1339-4cf3-a65c-49e3db748430", "value": "a1874cc200d21270547ecdb5e393e179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1020f78b-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075111, "uuid": "7b315f8e-5c6b-49e0-9067-c40ffac87eb1", "comment": "Malware payload (ConnectWise)", "value": "b2ddedc4e2a8870f44844afa3da2d3ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075111, "uuid": "c6b833f0-ee06-4326-b34e-7bf79e67fd53", "comment": "Malware payload (ConnectWise)", "value": "cf6b7d4d7e917a72ce9b524291aae29568127f1fb1577d897e3d5cfef00ab419", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075111, "uuid": "7684d08c-a5f9-4ba5-a8a6-b88ceaf2f6f6", "comment": "Malware payload (ConnectWise)", "value": "7ee663f8bfa972583a737983a76c3ec3c94af434", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075111, "uuid": "55c339d8-f328-404f-8ae1-1df4eb02ad51", "comment": "Malware payload (ConnectWise)", "value": "bf281130ecef0c57fe8660e0d7bbba6b4eb9028ea819a5ed8f86bf774aeeb48e240e5b877b2647d0cafc4c61ec5b5d0f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075111, "uuid": "dd0ca885-37a1-4443-9fa1-63a41f46a478", "value": "T13346E011F3D4D4A9DC7B0379D87A86326676BC0C8632C71F2398BA292E737814927767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075111, "uuid": "c4ab25d8-1c68-48db-85c5-d0cb3a8559f9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075111, "uuid": "41e083b5-aa0f-4160-a7f8-22a9afc89b92", "value": "98304:EfmE6+6efPU3nWn4bGbq6adYdsrGLPygQfpBws:GMefPUoWnsPygIpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075111, "uuid": "597c46c0-6eb0-40f9-ab61-f20ec6bdfdec", "value": 5743376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075111, "uuid": "d634a148-0fdb-455a-86df-39f919ecd0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075111, "uuid": "eacdc7a3-6a8e-47fb-89c2-8bdd2d8696bc", "value": "b2ddedc4e2a8870f44844afa3da2d3ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1914df0b-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694069113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069113, "uuid": "8cba50aa-4529-407d-955f-7fa035bfc665", "comment": "Malware payload (SnakeKeylogger)", "value": "6a93ca968134d4385828c36e200ad3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069113, "uuid": "3b326712-01ac-4687-9e69-53c20292fbd1", "comment": "Malware payload (SnakeKeylogger)", "value": "cf911f2a3e39d62d701bcd581b86436473feb19cba1c0935d0dc06d56056c184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069113, "uuid": "82902f26-6538-460a-9cab-dd261abd42a1", "comment": "Malware payload (SnakeKeylogger)", "value": "f0c636647670ff26474364b856937066aef68f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069113, "uuid": "270ca830-2b49-4a8d-a9f2-9d3206557976", "comment": "Malware payload (SnakeKeylogger)", "value": "522f8b81f2e508991c071acb107174efc4c53c037c50aab9221b86f177f8c9a4ae8ef762fef43c78f20524dfb20fe7d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069113, "uuid": "18246c22-4cb3-4076-925c-18195e5307a2", "value": "T146F3C4237BA789A1C299273EC6D705104F74E882B653E7497B8E23E90F437B69D09707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069113, "uuid": "2c82d0bd-2116-481f-925b-fb8bf4449763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069113, "uuid": "0306fc0a-dd36-4240-926d-dfc8bd73278a", "value": "1536:6v6YOgvQfmGdfJAjMF1YY6RlazeezaYL0Oym6iXOWVxZwLwAcDhXsn6rsEUsq9va:W6eQuSQyaiK/cwtv6rsEUs6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069113, "uuid": "2af693dd-6998-4ba0-9213-c003e33c07a9", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069113, "uuid": "1f133d8c-4174-4a46-8672-17a00a2c1472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069113, "uuid": "f5f9543c-8f32-4d1d-90c6-3dae37d82f86", "value": "42283523516_20230809_17202646_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1c35ff-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694094330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094330, "uuid": "bd309d1e-c05b-48d3-ba1e-427f65b27ef3", "comment": "Malware payload (Formbook)", "value": "1b109533be4b9351f0daabdc31f9c2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094330, "uuid": "9ab64856-418c-404d-a86d-2dcdb892e068", "comment": "Malware payload (Formbook)", "value": "cfda2a4566766c382c5a4984691463d8a2ef856175b03bfece01f467d12d97dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094330, "uuid": "d6bbdf93-6af6-41fd-bd68-d81c679b9bb2", "comment": "Malware payload (Formbook)", "value": "2458c466867a7aaa9593604f2052d272e1da2673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094330, "uuid": "61490554-7cf5-49fe-85fd-fb41a9f99dad", "comment": "Malware payload (Formbook)", "value": "277c5861980bc06fef3f675fd6c64c4584f3f84b54ca8f3e9bf47d07ec4509442d62c1d291fd3245a81d2ad6ec51a1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094330, "uuid": "119d56da-3344-4220-9301-7f5b231804f2", "value": "T17D058303BA87C9B3C559173BC5AB0C240F71E9A17213F61B658A236D5C437BA7E49E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094330, "uuid": "e502f4fe-ef5f-4856-93fc-36412c76299f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094330, "uuid": "64bb36e5-3eb9-42a5-8807-09133248d3ba", "value": "24576:gGgYdycqrT/zcqDxUj2sbrQogxASvoxvd5:ktT/wqDxUjdSv0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094330, "uuid": "587d0677-0f71-444c-b5e5-e10c12340309", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094330, "uuid": "48c248cd-a716-4bb2-b3bf-e4b2512011c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094330, "uuid": "96d47252-d0c9-4703-bc42-44f028bdc9d8", "value": "cfda2a4566766c382c5a4984691463d8a2ef856175b03bfece01f467d12d97dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efca6c8-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075324, "uuid": "a33f3e01-1873-4aba-92d1-7bda25c51751", "comment": "Malware payload (ConnectWise)", "value": "99fecd6860a6358e02322e80fcee3eee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075324, "uuid": "b925780d-6122-425b-9f90-38f0a0bb44ac", "comment": "Malware payload (ConnectWise)", "value": "d00c32beeab634334c6443755fc998408a1aa8017962cdd46d548053722ba837", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075324, "uuid": "a1db686f-09da-4da1-ab92-5214653e9005", "comment": "Malware payload (ConnectWise)", "value": "7c752112564ee5a2cf388d5003336bdff3a7a0cb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075324, "uuid": "9750bc62-1c4d-4b4b-9857-93d16c2f145a", "comment": "Malware payload (ConnectWise)", "value": "684de5acf4cf3777caba6a78abacec956bb7c9c3e7b4656e22ab2e610846fb248078e35c7097e2062253261af9728871", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075324, "uuid": "41ee5059-829a-470d-82ba-37dc1f717b67", "value": "T1A385F03136E4C039E2B21A39E93A92F15979BC20DA63C55F43A47D1E3971E8096B3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075324, "uuid": "f3aae170-107f-409a-9e86-a36e1e3551bb", "value": "24576:TNGryn8Y2KWeNXPKPC+j/4TkfVub1emjS4t3nHRRlUhUMUUGGHpYLgmdF8gu7ura:ZeyqkXSPkYYb1rSuRlU2XGHpYLgSL1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075324, "uuid": "e354a0bf-5a45-4dbd-bbe2-95ed015c74cd", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075324, "uuid": "c6517b64-00eb-4d65-9be8-a8bb3c74db33", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075324, "uuid": "b9c757d5-83d2-4f3c-ac46-5953b7bbcb78", "value": "99fecd6860a6358e02322e80fcee3eee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67d479b-4d2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694056573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056573, "uuid": "81e90824-e348-42ad-9721-eb94ad81a6c9", "comment": "Malware payload", "value": "9cbc21a9ed6e1525332557904760e570", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056573, "uuid": "6f16fdce-0df3-4056-b3f6-c26469492228", "comment": "Malware payload", "value": "d01d9b66eafe89da8b1b3cb45b194dc7d770c55bcabfb752c13f2b835b864f05", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056573, "uuid": "97625e12-d5ad-4145-a650-417a13bce814", "comment": "Malware payload", "value": "21b529aebd90312dad00c4bb46744b602d7e6242", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694056573, "uuid": "dde4747f-d97b-4dfa-bcd7-b515f389edf0", "comment": "Malware payload", "value": "dc3b6a08b3ba1233ce1e8443252fb21214dfad65de7ed2db9e491894591a3f27e3a4410bb3133367b45cde7eb479f2ad", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056573, "uuid": "5197ad60-cf7a-4858-baed-d08b0675607b", "value": "T1C684F7876BE60FC6D27756316D6B86406B2DAC46B547DF0FD644B3093FBAA806D0230B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056573, "uuid": "7dfc4f35-b098-4d43-afc8-5ad299396fc7", "value": "6144:6bVflDcacWc6oRaHUNJUPG1o98Bjr6PRBy9SY9bNtdbwtm8shKW4Idf9t8qre04I:Wqre04CDiWmi7DPoCR71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694056573, "uuid": "c443d149-57d9-495f-88de-f9ba6c510427", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694056573, "uuid": "bf69ddb0-76a0-4635-9ef7-a1c015c2936e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694056573, "uuid": "0367e56e-181e-4c2a-8a29-111d21bcd3d7", "value": "9cbc21a9ed6e1525332557904760e570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998fc9d2-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075771, "uuid": "6adf587f-f0bc-43d2-971f-0e29d724b992", "comment": "Malware payload (ConnectWise)", "value": "e083c17ca7e6bed10855ccbb9605d1d6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075771, "uuid": "e570b9b9-2565-4c25-bb7c-413423431c99", "comment": "Malware payload (ConnectWise)", "value": "d04293e5a6538ffae23517c76f567e050f29922276aef13f3193e0a036c607aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075771, "uuid": "886c6842-8d0c-46c8-a2f9-e4f522278cd8", "comment": "Malware payload (ConnectWise)", "value": "679029e72b27895275f38cdda34cc97b732e0c7c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075771, "uuid": "d99ab1df-576b-41a8-8e38-df71244b917d", "comment": "Malware payload (ConnectWise)", "value": "d721323786e3fed24291a416c858f0c68c15a531540de2bdf38819383f530695d5d2a1360c0bb7310a504c9ce315cadf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075771, "uuid": "3294474e-2039-4330-a8f4-ce123e3eade0", "value": "T1C7835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075771, "uuid": "7081988f-e544-4a21-9372-e3a1a67f3390", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075771, "uuid": "92b5bd0b-075c-4b49-8b72-40bd4d7f779b", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Dk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075771, "uuid": "afe5e8e1-6405-4c74-97c3-1234024147bf", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075771, "uuid": "ea20d39b-2193-4d34-a706-5e0748b85856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075771, "uuid": "ca35a22e-947f-43ec-9706-366b5dbb9dda", "value": "e083c17ca7e6bed10855ccbb9605d1d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f1b4c8-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694084724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084724, "uuid": "a2394e54-cce7-45ae-a0e1-17823bc27776", "comment": "Malware payload (Cosmu)", "value": "f052470d5cc3c330d545582978bb312f", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084724, "uuid": "37bfbf81-6205-4fc9-af67-8272deea7552", "comment": "Malware payload (Cosmu)", "value": "d1cbb80ec075d160bf51df7df34c0496a8741e9be0b1ff527da216e7c0833575", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084724, "uuid": "72e8035b-d0e9-4cab-8b54-03d96f18d983", "comment": "Malware payload (Cosmu)", "value": "043ce8c0a5fd75689fd88c448433a1c3e4a0ce05", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084724, "uuid": "7b1e5f39-82c3-4d9b-aeb4-32110798c3d3", "comment": "Malware payload (Cosmu)", "value": "b5b21827a360539450611c85db5af4bea9ea88fba0eb1faff92339adf1c44f4343cd0e0831086806244e57dbaffdb7a3", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084724, "uuid": "9982923b-6698-422a-a53f-2ceb9fa1bb9e", "value": "T1CE54D0113A9EC7B2D3C28832CC6DFA9147767D2F9B61D137B7983B4F1E712885A66201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084724, "uuid": "d70ce964-7268-40d1-9d4a-6c7f6b1dbd2b", "value": "5aa33c577ffd8431ff254de85dee5e7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084724, "uuid": "4c27e418-ae81-41a1-9128-5b6369f67a99", "value": "3072:Pxv/y9LJ3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBVw1:JamlKgzelZNQSBQGH/CSpWqTzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084724, "uuid": "cffa0f4e-d993-424e-8297-ef8fabb10162", "value": 291154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084724, "uuid": "aeee869b-9d25-43f3-a2c3-16e10030a712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084724, "uuid": "1256ebf1-5bd9-4132-92ca-34243071544f", "value": "Virus.Sysbot.ATA_virussign.com_f052470d5cc3c330d545582978bb312f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f4faf3-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694095928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095928, "uuid": "c0f41a34-d0ba-473a-9a1b-25c10c797293", "comment": "Malware payload (MarsStealer)", "value": "c355b99570da266a34386b88cb5862a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "PWSX", "colour": "#EB94A1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095928, "uuid": "0e815dfb-f7b2-4799-8274-2ad87d08a1f7", "comment": "Malware payload (MarsStealer)", "value": "d1d7bb6d93800bce07df9d3bceb824f47a893000bd7275350a3e55f8963dfac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "PWSX", "colour": "#EB94A1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095928, "uuid": "21b5b44a-e3fc-4250-aea0-24c2cff63684", "comment": "Malware payload (MarsStealer)", "value": "9a1b33ed6137ec6f40ba8216ac3e9ffee0e15275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "PWSX", "colour": "#EB94A1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095928, "uuid": "e3e78957-d58a-4692-8a69-cbbf372f8ddf", "comment": "Malware payload (MarsStealer)", "value": "c8b4f0b50ba7269f233e3ccb8f321bc1e021b6c541adfb14cb64d75f92336f7ab8ecd1d5fecbdc5834e0cdb3c22e1df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jaik", "colour": "#AB1E6B", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "PWSX", "colour": "#EB94A1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095928, "uuid": "6e61f839-6c37-4ef7-a1ea-573c0d57598e", "value": "T17E85333008A19D11D5B877FBEB7ABC13AFA76653623D0E1C5D6F8B3342A6FE91581804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095928, "uuid": "57e84dba-5dab-4429-8c6b-5b344fd3e759", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095928, "uuid": "afa23c6c-6802-4ee8-a4f9-e02bb0c5e313", "value": "49152:gG7PRfvfuuPLsPCGuym7O+xMcNhsMFSyqQ1mvUJdWdl:gGBSjm7fxfdFN/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095928, "uuid": "23490341-b211-407c-9178-bb999a416808", "value": 1768960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095928, "uuid": "91301b49-f772-44cf-8156-8bbb794396d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095928, "uuid": "dbd4388e-ebb3-4e37-98ab-89d923bc6729", "value": "zvirka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a574d9ee-4d97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694102420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102420, "uuid": "aca85f1f-6708-4a07-bdcd-3a5ca8f5a7d1", "comment": "Malware payload (RemcosRAT)", "value": "b7c838206466275a94ad5af700491a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102420, "uuid": "e6055766-93cc-497b-afd8-de63e4bc5766", "comment": "Malware payload (RemcosRAT)", "value": "d1e1c9332fa8a6bd045fd4ccfa11055a4e17d1cad72239aab2400870191c4185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102420, "uuid": "ad9ead5d-a9f3-4b3f-b482-b89297f53d8a", "comment": "Malware payload (RemcosRAT)", "value": "34815e4e485bfa79c48bc1c33748fd009e6e6c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102420, "uuid": "7dc471a2-7da3-416e-b95f-704dd6dc47df", "comment": "Malware payload (RemcosRAT)", "value": "ab7fba29c958c93ac34cbe1d0843c72089a8441fcb858735891d9ea91463b81889fa01062c2bc4c2eab63092632c8c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102420, "uuid": "77995b8e-df66-4777-864e-c3b7a6bc0a4d", "value": "T117152222322B3F5AD4F66FF201005E6503B47912A820E71D6DE257D775B8F49A6B2F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102420, "uuid": "1372e22f-8fa0-4bed-be29-893b5615953b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102420, "uuid": "2e6ef9c0-1192-4c54-908c-96d185043181", "value": "12288:IOC0hMHyITjhJlxSBTNh9PdpUZAYxK5O0ruBaO4L0kAaJvP94K465xACTiYqHxzL:IpSqHrnSBTJkGY1eubRE35xxiYqmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102420, "uuid": "d3aabf47-cc49-4ac7-8863-34f6d9ccc458", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102420, "uuid": "7db89600-584b-4434-9892-b106c779a467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102420, "uuid": "81a69964-1247-4d37-9f5d-7332638c280c", "value": "b7c838206466275a94ad5af700491a1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb62503e-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694103316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103316, "uuid": "db4150a7-9f3b-49ad-892a-5b6e1ad94b30", "comment": "Malware payload (GuLoader)", "value": "b562afba605b12204beb53bf3edf8d71", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103316, "uuid": "b514378f-b15b-435f-890e-82f89b118598", "comment": "Malware payload (GuLoader)", "value": "d292d459a8e8f93e1ae506920f8c3b25ee10c4d6dd3c1e04905bdfc4b2402e91", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103316, "uuid": "bc36a01f-15a1-4e3d-b194-2fbdd7785f01", "comment": "Malware payload (GuLoader)", "value": "31ba7d384d953d8be1c6d07c84858853a0ad6f92", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103316, "uuid": "f1620871-6bb1-4788-b593-367215be3e95", "comment": "Malware payload (GuLoader)", "value": "650c20a64655cbb8a366de32160592009903e08a4117274fc18d09e0677086dc8e380a61c6caf57ee2bae06b85b6729c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103316, "uuid": "8a97b35a-575e-4d9d-820d-b0ac886221eb", "value": "T115926C5A8DD11A30060B26FB9E895171D4BC40778168907EBC8FB73D4612B8D6F7EE8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103316, "uuid": "12d70cc0-3bf1-435e-a734-56c3b11e7d26", "value": "384:MTfO6Zk0wy7gXqzHhYT2x+//7JORPNQ7uWZ/YkTHhXNbjp0DS:cvZ2ag6zH8Z/tkPNIuW3TH1NhGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103316, "uuid": "4511703c-3c62-4402-bb1a-6a43c3c406c8", "value": 19750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103316, "uuid": "05412212-4443-48ba-8ec0-b9b8545e5402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103316, "uuid": "0d39377f-93db-4d87-8c93-02eaf9300c60", "value": "CFDI_C000423_A38394.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc3cdd5-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694069281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069281, "uuid": "126e109a-2a80-435b-b023-ac4fb3c05017", "comment": "Malware payload (RedLineStealer)", "value": "0ebd3010bd265409db069173ff04a83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069281, "uuid": "f8923520-625f-40dc-a15b-8b914e2f7322", "comment": "Malware payload (RedLineStealer)", "value": "d3d80f20a6a2bc313f28a6230e3b44585ea2798de8afb5f707f7ec2fc416dd85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069281, "uuid": "95e1cc39-90de-41cc-b4dc-aef7d8e20ce5", "comment": "Malware payload (RedLineStealer)", "value": "7f69749add7b5fc9dd1f29b813ff5abfb091fc2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069281, "uuid": "0161aaf2-c26e-47e0-b8b2-66be5ada6d63", "comment": "Malware payload (RedLineStealer)", "value": "4449b2037e3b51d0a05a2590d6f5af4085edb7688e419fd08ae3e6aa5939bc29a62ab43d1d83a31626a5c617c48c00d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069281, "uuid": "a499c9e7-3e16-45cf-9ad7-7d18a554e340", "value": "T130644B24B0D89421E4D35B302195B628A457E8630DD85A6F3FD202A73DFCBD2B55CEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069281, "uuid": "577f3dd2-42e8-4f08-ad48-860a25b63243", "value": "400fae606eea09461828e01f326155b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069281, "uuid": "d6fc1879-35b9-4276-b879-5569b918f7a6", "value": "6144:c+tPEVq7WkrbI86J529fdAFlj32pHHyNoakqyzlOHy48zRivjjxfBlyZB:c+tPEVq7WiI86J52YljeaobqypOHy48/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069281, "uuid": "9b4f3ac1-e4f6-4a31-87bc-f96269c07871", "value": 319352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069281, "uuid": "23e34f6a-83fe-49bb-99db-617f060eda84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069281, "uuid": "3f2cbd3d-af30-4e27-be2c-e5ccaa8c0dda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281fba59-4d84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094049, "uuid": "63c22111-8d96-4fcd-b138-40c4cd52ed80", "comment": "Malware payload (AgentTesla)", "value": "1fb9d1a23ea55695ee3e2554494f6eec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094049, "uuid": "4f9bfefc-3110-48ec-906f-9437ca714531", "comment": "Malware payload (AgentTesla)", "value": "d43fb23dc98239df82f9c9b8c8935f3d3222eaed80bbf7a64737d79c8385f6df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094049, "uuid": "05635ceb-6b91-4cc5-86cd-ed02cbd36b16", "comment": "Malware payload (AgentTesla)", "value": "e4ae39764877ef711f86661bc677022786c70d5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094049, "uuid": "8f704e07-d1e4-4f85-b941-6b8ede99394c", "comment": "Malware payload (AgentTesla)", "value": "b9f56eb53841d7c3f82997de19fe664d53957088a44505e5a347e827594e1e32bb7adc600e96b8cb18d8b8c39cc2dbb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094049, "uuid": "dfb70381-976c-455b-8cee-b43ca2f43b6b", "value": "T1FB34FE077E48EB55D6983D3782DF6D2813F2A0C70673920BAF48AE656A412537C6F36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094049, "uuid": "08838cac-6ad5-4fea-baeb-73b70e0e63d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094049, "uuid": "0a86be66-d3f3-41d9-abb3-457490f7a4aa", "value": "3072:b4ecKlxGj5ksYWRJCFDfVWYk8Gs0ASQJuhvk0c+TbRk7P:b4/kkjKaRJCFEbdhfc+T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094049, "uuid": "e0245c83-ba0d-459e-8ec7-53054462a25b", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094049, "uuid": "61e3316b-136b-41b8-ad74-5ee6b1ca6e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094049, "uuid": "fa6bbcbb-a108-473a-985d-8b06ea4fbcaa", "value": "d43fb23dc98239df82f9c9b8c8935f3d3222eaed80bbf7a64737d79c8385f6df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdc46fb-4d49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694069066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069066, "uuid": "b0c960f0-88c1-41fd-a81b-ab0e19f21b2f", "comment": "Malware payload (Formbook)", "value": "e144f44d324b0754f2f524fe6f3e3bf8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069066, "uuid": "effbac0c-56b3-4736-abd4-620fe922add4", "comment": "Malware payload (Formbook)", "value": "d44232f2022c8c9e948b4fc026cc391959c2e662a152b77e95dede5989320c27", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069066, "uuid": "04bccdf0-5dbf-4260-aff1-4d3b07bd049a", "comment": "Malware payload (Formbook)", "value": "b0bd503740e4357886a4bef065ece2da1e06bb19", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069066, "uuid": "1967a450-64d0-4228-801f-f5b3c48d101d", "comment": "Malware payload (Formbook)", "value": "f018dd96fd4ef774a6ec7f39b1fa222ace2bf87aba5a6632a396a09f40ee701b3f1386b2222012b7504437b5b0ee9592", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069066, "uuid": "46b68146-55c9-4015-8da9-cc725093d32f", "value": "T11A8412D1A1A0C8E3C4922772C8B685F93A61EE37DEF8911F1398FF297972153491E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069066, "uuid": "f7bdaa6d-9b4f-4ee7-8afd-bea373160877", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069066, "uuid": "3a1ecf97-e219-4179-91b0-3f254a772af0", "value": "12288:JY1g4+L/L3O72gj558ygOY+e877tC/ssZDBqDqO:JY1gt71Q5RVe6tTsZDBqDqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069066, "uuid": "2c7f9f5c-6bfe-4fc8-b5b6-9ee6c63c7927", "value": 403688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069066, "uuid": "d7ac1f91-266e-49fd-96bf-635d6d93ee64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069066, "uuid": "ff2d5a8c-157c-4856-91d1-12269f78231a", "value": "DHL DOCUMENT SHIPPING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af029c57-4d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694066788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066788, "uuid": "6144bc5b-a8a3-4faf-b52e-49ffd3916652", "comment": "Malware payload (Amadey)", "value": "b87a8c88ccee7bcdd33e3a217756b07f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066788, "uuid": "7103b8f9-349b-487b-9ab6-79ff85e7dea1", "comment": "Malware payload (Amadey)", "value": "d4463b448b1d6850d136f4ddf5e7a04db78fa3a64b57dfdb04e1bdd1f27faa4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066788, "uuid": "3fc82a3a-5cdf-464a-af52-1368077874a0", "comment": "Malware payload (Amadey)", "value": "8c0ac5d5ca8616ef1bb78d7a10f25673cc8bfe23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066788, "uuid": "8c1b36ef-8766-4194-86df-9848dd6be367", "comment": "Malware payload (Amadey)", "value": "08e1e5e5ba1db22ead92c1129deb21eb912055d9e23ddcd71e656ec4ed608d5904e185ac885c0621a01e8eed3c2dbab7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066788, "uuid": "d89b72e0-fc3f-4611-a9cd-c76c24344ab5", "value": "T10F24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066788, "uuid": "72c542d9-903b-4233-8199-c8232ef42242", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066788, "uuid": "f5334620-3849-40f2-92be-f71244c93b9d", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694066788, "uuid": "d2a2c4ef-85ee-43e3-872b-e2c8736f1cad", "value": 225820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694066788, "uuid": "9d41acde-07c9-4e90-bfb7-088b02de55b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066788, "uuid": "72ba6a69-b470-4174-8df2-32d219353a7c", "value": "b87a8c88ccee7bcdd33e3a217756b07f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a7b49e-4d98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1694102696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102696, "uuid": "d2a1e0eb-fc97-4253-9930-6acb7450eb7f", "comment": "Malware payload (Gafgyt)", "value": "7fa498cde8481a9be682444d0ca9d0e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102696, "uuid": "20724b69-493e-4c49-8843-6c99792ee48b", "comment": "Malware payload (Gafgyt)", "value": "d45380acbb2e4509dac898e361f71bae43dca761e33cb38b160773954137ab1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102696, "uuid": "a6f76acc-566f-40c1-93b8-c83aef640213", "comment": "Malware payload (Gafgyt)", "value": "4ceb032e1be008da8143647b4417b798943fe9b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102696, "uuid": "33bbb5a5-117d-4a9e-9cbb-9b9f8a4f9f43", "comment": "Malware payload (Gafgyt)", "value": "6657cff2c3ff6183234664ea7b91671aef5d9b07e6199ec1ac8b2c7a9b9bbc4756f83d26e2a33461cfcda4b5e564b57e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102696, "uuid": "a06ed91b-1582-4bf6-b1a1-21d4a41568a3", "value": "T16D242A45AA408F13C4D627B9FB9F42453333AB54D7E763069928AFB43F8779A4F62201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102696, "uuid": "727804f9-3b50-4578-b805-b759ded5ce51", "value": "6144:ZzjkF7LHkj9zaCHxedfm1lQE/wa9v0HoE2M/RMOa+:Z8pHkj9zaSxedfm1lvYwvrEv/mOa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102696, "uuid": "7e0870a4-77e4-440c-aa78-f28fd49ed4e8", "value": 214939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102696, "uuid": "631a1167-2caa-491d-86ff-48540f5f739a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102696, "uuid": "10dbeeec-6ffa-4fa6-bb76-69fd82b50abf", "value": "7fa498cde8481a9be682444d0ca9d0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40abf495-4d6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694083353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083353, "uuid": "a6d686ca-68fd-4c66-b2e7-65c32975354d", "comment": "Malware payload (njrat)", "value": "ba9ba0fb3e9df566a91cb90f59b23229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083353, "uuid": "e9c93bf1-fed7-4774-8163-4f22bd0af228", "comment": "Malware payload (njrat)", "value": "d46517219fcad69c49f121a9bed162ee81f802056d01c62c5cec896a1c205a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083353, "uuid": "056c0d36-7ae7-4c9c-9d81-420f56ee62af", "comment": "Malware payload (njrat)", "value": "9a86ef2c9b02e374182423507ba6143b24c8ad59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694083353, "uuid": "9f6c545a-ef15-4bca-aa4f-ccb14d1384ec", "comment": "Malware payload (njrat)", "value": "726f9dfd4c6cc152a1c7fa324c8b54c6aae528f3767da4a6c62ccc701fcd07212e9a5974ea972b98ad60079850e86699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083353, "uuid": "d79c91b5-4e07-4ba1-9509-973ccdcc990a", "value": "T11E432844BBEA8A05E2BD8F3468F665150734AA23E632DB1F8CD558DB13327C58C44FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083353, "uuid": "f0e0a3a9-5e3f-45c8-afd3-14ce28f95854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083353, "uuid": "a33cd7d9-e351-461a-9f7d-6a22dc7086bf", "value": "768:fh0vMDx2EsltrXfdFbI3mzJSN/xWQG35bmaePD5PvhmXXJdxIEpmzg:fhv9GtrXfdZIgGZWQcGD0X3xIEpmzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694083353, "uuid": "dc254179-d1d0-4520-b0b9-a4304632146e", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694083353, "uuid": "bfde6f5c-cbed-4526-84e2-52b4e71904f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694083353, "uuid": "0af03796-7494-4021-98dd-d78d2ccc5478", "value": "ba9ba0fb3e9df566a91cb90f59b23229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fc0108-4d94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694100977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100977, "uuid": "d4c72e02-5c65-4ce1-ae38-d3e3061e713d", "comment": "Malware payload", "value": "46da2e7081f81f4facde9b711688fdc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100977, "uuid": "d8c0b636-409f-4aa5-b0ef-8b2618f89f1a", "comment": "Malware payload", "value": "d5347f2a5056605c06d2dabc9b6835719f8d96bca47b2f25bea632fee255f268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100977, "uuid": "db26aaa3-622c-4920-9eb7-20d07da37bb8", "comment": "Malware payload", "value": "6ea9c3c22415834d729e76fb7fbce6478173832f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694100977, "uuid": "507473a1-cf7f-4ea1-911b-8244f6d59cc3", "comment": "Malware payload", "value": "43402fec66a8dfe679e0d235880f4f1a5f7a917e318c11e5f25217cfadc01b7eaa993db472fa905a09a8f0145ebfbb6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100977, "uuid": "0dde3c98-3214-461a-958b-97543be2a164", "value": "T12744AD11B6C1107BDDBB0B3248249A3866FDEDA50F107FDB63C06A769A71B91C9A7307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100977, "uuid": "8c979c72-6812-46fe-810a-2e81529798e8", "value": "caa8d22a27bdeecfeb10143eed185335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100977, "uuid": "d22a2a1a-7977-42c0-b245-2dc85fc787ac", "value": "6144:GtpMplhoSByJCTT8A7zE54w2Rv6I2TsbSssj0B:GtpaboSByqA4hRB2QbSsswB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694100977, "uuid": "76704487-166b-45f9-b7d0-57a606910374", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694100977, "uuid": "4042cec0-17bb-4b46-896b-d4b1aaf77232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694100977, "uuid": "80ec6059-b279-49e1-b7c0-87620b360420", "value": "SecuriteInfo.com.Win32.PWSX-gen.17793.16328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a10b8a-4d15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694046700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046700, "uuid": "03b2c755-76f9-47c5-8e54-6d115960ec25", "comment": "Malware payload (AgentTesla)", "value": "a0c6d20234582f2d6c8a5ce5d349c9d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046700, "uuid": "e2f001b5-dee9-43cb-9254-4f77de04cac2", "comment": "Malware payload (AgentTesla)", "value": "d62ab80a981120bc862738658cae6128082845908836dd11bbdd8c9e7995b17a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046700, "uuid": "2f0422fb-420a-41f6-a8d2-4a1e801e9180", "comment": "Malware payload (AgentTesla)", "value": "402ae3004f3df01286e62065fefa96c6d6950aff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694046700, "uuid": "ef90089d-eff6-4ba5-8f49-adba1fa51563", "comment": "Malware payload (AgentTesla)", "value": "b3be1ebeaf74a407cc668c46ff4b07dd4c9ff814e2768ac2cb7599c6fdb0d88c76effcbcf4af9dec6c4113955a55ba6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046700, "uuid": "089ea2ce-6639-414d-820a-507879b9d4c4", "value": "T17F84E907BA87C8FBEA892736C797140403F1D58D639BDB0A798A13A548433BBDD41DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046700, "uuid": "5c5783cc-050a-4913-b75c-9edfeb5c298d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046700, "uuid": "1e0c1d78-a297-4496-98c1-c0840b1d8711", "value": "6144:/eJOJ75EespSq1YFN4QhuHAmZ7FvJiooDwoMwZ4owu2TlAMvBf3:GJk1Ex1440iZp5oDwoMwZ4owvTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694046700, "uuid": "5bd66bb4-637d-488b-aedb-f44b560ad195", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694046700, "uuid": "95b0ec94-fb4d-41a3-9ad8-cf70532d6881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694046700, "uuid": "065cb1fc-8dcd-467a-9955-d762855a04f0", "value": "SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.1667.5219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4153bf-4d19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694048186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048186, "uuid": "6de04617-4bc1-4087-ae15-e6a113ff5c21", "comment": "Malware payload (Amadey)", "value": "a0bb9d49a788df5e7b6eb22c95001bdc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048186, "uuid": "94645904-1e65-49c6-8d3d-f715d9e6e4f3", "comment": "Malware payload (Amadey)", "value": "d65d100980dc0b3f4d2d1ce3fb8118779c3201aefc43d2fda6020d805cc334da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048186, "uuid": "28272544-633d-4cc2-9443-2d053f0ada56", "comment": "Malware payload (Amadey)", "value": "99490a2c43ca908e1a569f171c51c292d7d3ec06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694048186, "uuid": "3759cbc6-ef27-465f-82a8-46cd9139b88c", "comment": "Malware payload (Amadey)", "value": "db136c3d6db89fb48be7128dc08c6efe4b6544ca5998594528aa7d35c18c85a32efa55a25fe006156e76346ef8f9e3df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048186, "uuid": "0e6a2e35-2c24-44c3-afa1-472185a4ad00", "value": "T1DE24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048186, "uuid": "d6b4f15c-a059-41bd-b941-55a04656b435", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048186, "uuid": "d3460ba5-7500-4818-a3f2-ddefa1905630", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694048186, "uuid": "eb8f15dd-51fd-4124-a02b-e2b9935042c8", "value": 225127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694048186, "uuid": "b82b93c4-7252-453d-9445-af3ca652e7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694048186, "uuid": "1192c932-ef9f-4ba6-8f03-122efc1eda1d", "value": "a0bb9d49a788df5e7b6eb22c95001bdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937dd33e-4db1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694113557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113557, "uuid": "4945c426-3d1f-47c3-9547-2e8ac505e78e", "comment": "Malware payload (Mirai)", "value": "6733765be54609522491ce35a3baa886", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113557, "uuid": "41c61dbf-7c35-4df7-8d7a-56576339b944", "comment": "Malware payload (Mirai)", "value": "d66caf40020378fb10741c311e38dd68ec59b7d705366a8edb214e789f7a6c9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113557, "uuid": "968b76d3-6b6e-4bc6-aee9-179e389c447c", "comment": "Malware payload (Mirai)", "value": "663da28f91ffa20245f13dc1b571a0edf90b36f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694113557, "uuid": "9b528db4-1a9e-4481-a8fa-670a0f394b4b", "comment": "Malware payload (Mirai)", "value": "827c6a4830734634223fd9cc0501dd68b2c242aaf09b9af1f40fbcf670a85f03db8191ca0adb1f326c910e319cc19f74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113557, "uuid": "8051b147-b15d-449b-8bc1-c2af1605d7c3", "value": "T18A834AD7F800DDBDF849D73A85934909B130E3A10A921B327323796BFD761A45827E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113557, "uuid": "4f66d2f1-9e59-4537-99e0-9c3e2bc37930", "value": "1536:Qht1/cqinfC368o2zcn0iq8U5mh8tzmFbyFAB1bXEdfHlFkZQv:Q31Snq3Fv4pU44mFbyFABVX88Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694113557, "uuid": "d78f156e-d77b-4b83-b088-e70e728a4c58", "value": 82804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694113557, "uuid": "261caa6a-a9bb-474a-8494-a0e1bb33d48e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694113557, "uuid": "356c8992-05ff-4eed-9ef4-8e2c3d897596", "value": "6733765be54609522491ce35a3baa886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd52d8cc-4d6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694084529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084529, "uuid": "4e3192b3-9993-4907-9b52-5b19944372dc", "comment": "Malware payload (RedLineStealer)", "value": "217f6100dd86d74e1abfc73601f05ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084529, "uuid": "5c868c16-713d-46c1-b6ae-31d43e5dceb0", "comment": "Malware payload (RedLineStealer)", "value": "d6c4bf4cc514f6fd12b65f46393854c439de31ab5fd910dd9910d32dd96127eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084529, "uuid": "01bc7715-57be-4585-871f-dac737148af0", "comment": "Malware payload (RedLineStealer)", "value": "924dfb8fd713ca156fd4ad61f46d70a3465f3873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084529, "uuid": "7b955ff2-fe9f-473c-b90b-9d46a655f40c", "comment": "Malware payload (RedLineStealer)", "value": "8f69a18d16693ff178596e981f12acab68be2ca3cc3591d7e0ca98c8aee3d8cd03aa39165efb42e22ec8162266743649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084529, "uuid": "a7449e40-7b78-4ae6-8f6d-50cc5d68d05d", "value": "T12504B4583647A97EC96F487D9D700CE0777CACA21246A7079C8EF4E83A3B7819B051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084529, "uuid": "dd86ed65-83c1-460d-a272-afbd2b53b57c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084529, "uuid": "31fc6478-9d66-4a92-a368-c82f992f3c45", "value": "3072:Ywx9ioXI0isI0MOwgjNzelr58E0okAa7BC1JV8e8hy:YwRXI0isI0rel18E0T5C1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084529, "uuid": "977dcc5f-cc8f-4417-8300-743ac0a77902", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084529, "uuid": "43edb6e6-6049-4b3a-b80e-409240e396c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084529, "uuid": "7dbfc3a7-64a0-49f1-8add-273d43eae633", "value": "d6c4bf4cc514f6fd12b65f46393854c439de31ab5fd910dd9910d32dd96127eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f26717f-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Urelas)", "timestamp": 1694085042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085042, "uuid": "cc79118e-4707-4e63-b4be-33dd1c7cb7c7", "comment": "Malware payload (Urelas)", "value": "f0363f2a84f909efaad401a3ce9829c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085042, "uuid": "e9192bac-ec53-4638-b487-9642571a2d68", "comment": "Malware payload (Urelas)", "value": "d7669c70e5752d235879a9493ede28eaa7015acce4f26c518f0067dee2819ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085042, "uuid": "266943b5-1dea-4af7-b3a3-26c6aa9dfa71", "comment": "Malware payload (Urelas)", "value": "c1eee6a1de1f3266be419888e28760baeedc5f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085042, "uuid": "783ba36b-c000-4cc3-89a8-7e0c512a56af", "comment": "Malware payload (Urelas)", "value": "9c10259e8bbf5461d811e230d3f04b91a0b6ed80f48818617aa345cc34a1c57b1cb41c409cc8b923d7e85c24ca1c2c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085042, "uuid": "003b765f-001f-44a1-a5c9-be7a46965a35", "value": "T1F694AD2562408475F3AA0B3049A5E6F50868BC3927A4E58FF378BD3A2D701D35A7739F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085042, "uuid": "2311def3-b2c7-42f2-b2f7-ddf7f1aa0f61", "value": "b6852ed4e334147c4929ea4ff7285899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085042, "uuid": "e754a130-fa31-4501-b2c3-b392afae451b", "value": "6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibG5:rKf1PyKa2H3hOHOHz9JQ6zBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085042, "uuid": "6ec4294f-26fc-477c-8b99-9d901eb36207", "value": 446282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085042, "uuid": "f5707382-a2ee-4b1d-afad-1e878630f8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085042, "uuid": "434870b2-041b-425c-9218-13c8474d3dba", "value": "Trojan.Autorun.ATA_virussign.com_f0363f2a84f909efaad401a3ce9829c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd27a6c4-4d4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694070785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070785, "uuid": "f49b3d90-a547-44b6-ab1b-decab8da7e59", "comment": "Malware payload (Amadey)", "value": "0cb8d65f7c38edc2fb1d0e2ed4726dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070785, "uuid": "dc10cd55-1831-47f8-957a-2d6bfd77044d", "comment": "Malware payload (Amadey)", "value": "d940129b7c22e5b27b3e7b54a01080107b182d5667900ffc678cad0ebaa6da0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070785, "uuid": "e4bc191a-a048-4b63-ae78-64e4e99c7837", "comment": "Malware payload (Amadey)", "value": "53c5eee5aefefb5277597095f0ecbcd7bda75899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070785, "uuid": "7839341d-e175-4d70-b381-e8e39435dd74", "comment": "Malware payload (Amadey)", "value": "8ad306f716649eec9e7080ef1cf905011becd303369d4eedef43f42ed37c45dc50c34746af356f686b81da2998577103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070785, "uuid": "ece1e309-b8cf-4bde-80b0-a55ad873325e", "value": "T19924F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070785, "uuid": "aa4d94b3-88ff-4039-8190-779966b55b70", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070785, "uuid": "a3080daa-9194-4b4c-88d0-5ad6296fdc83", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694070785, "uuid": "d79dbe4d-298b-423c-a206-fb5b2b16f13c", "value": 225869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694070785, "uuid": "bbff580b-0b42-4248-bade-80b4122b0f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070785, "uuid": "10713e22-918f-4c35-987e-05bc8995c86d", "value": "0cb8d65f7c38edc2fb1d0e2ed4726dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d6c003-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069192, "uuid": "ffbcc6c3-1b09-49c5-872c-b970ab66abc7", "comment": "Malware payload (AgentTesla)", "value": "e7017fd017f4afc3e0ed41b437b062e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069192, "uuid": "543e47cf-9541-4504-8837-31df40589cd9", "comment": "Malware payload (AgentTesla)", "value": "d98ed54790efc6d718d719228e2bdbf4295cc23c94c22c6d77b55217337f860c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069192, "uuid": "d4fd236a-08fe-4238-9c6c-258bdcf9a1f1", "comment": "Malware payload (AgentTesla)", "value": "a51dca6a6a76972205fe73f0bb5666e36e381153", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069192, "uuid": "dcdf5fed-9b81-443e-a54b-d2ca5e0a8cc9", "comment": "Malware payload (AgentTesla)", "value": "3cbda7c96566cd5d66f6241b90a2bb8c6549789b201a6e44dc56ff337a484a27b475ae5f4ce8a863959013df5516713b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069192, "uuid": "97ae89d7-6c1a-408b-b078-0dd1d136436a", "value": "T16FD41245F3780B26C27A67F190512068437BBD279172DA4C5EE3B0D739A27720B92F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069192, "uuid": "43a7e915-9e52-4cd2-8610-0a06437230ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069192, "uuid": "ed990c67-5ed6-4fc3-bb89-c054fe5e42e4", "value": "12288:j322iNHkDwMD8lai/1+IaOBSOJ3ObRFxhYkbsCwVf0LeDyqm:j321RkDV8I0+I9BSK3ObRPh4XVf0Le2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069192, "uuid": "5df9923b-bcc3-4b8d-9c9a-ac0031e04dc2", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069192, "uuid": "11452842-e97c-4ac9-8d2e-33125fb9474a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069192, "uuid": "ae5d6e2f-d105-4b19-97a0-53c54ea76c28", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2de3a75-4d81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694093047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093047, "uuid": "0fa1cc05-9946-484f-95e5-5564cc62fa5e", "comment": "Malware payload (DarkCloud)", "value": "a70bccc1249451db8f53cd180c689ae8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093047, "uuid": "36baa534-db09-451d-b276-d147a5cd9c06", "comment": "Malware payload (DarkCloud)", "value": "d99f72c298895809260b08284f4b62ed07680b3aef96b6ebf0155e0690bc0835", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093047, "uuid": "1bca0146-0eb0-48eb-9f5d-0de29e7cf533", "comment": "Malware payload (DarkCloud)", "value": "ed1e18d4d43be89c9f11212c098f57fea1606358", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093047, "uuid": "1787d77f-aae5-4946-9c5b-44ece8d8c58c", "comment": "Malware payload (DarkCloud)", "value": "1bce0d900feb53d3d85c4b8d221911564154b41199b14f31f03999759a8b7f785db641654260cfabcf42738fe85e924b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093047, "uuid": "ba79a915-027c-4f36-ade2-ddc78c3cf13a", "value": "T116943B17EA10712EF5A2C4F0EAD49217A8956D3A1268E827F7819F0936355D3ECF132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093047, "uuid": "bfcb622f-2ed2-42b4-bbdc-15d56835a703", "value": "d02a240dba5725a7fc1488f5b3ec984e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093047, "uuid": "f3103d46-ae50-429c-8158-185d163b1e86", "value": "12288:wNs209hEet8Ut82TfIcOoIywhTswjYKkJj6GmZU:b2iEYAoIXhTsmYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093047, "uuid": "27802080-c863-457e-a3fb-cafff0eb2f47", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093047, "uuid": "463917cf-820e-4641-b787-a014f2cca59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093047, "uuid": "fd794ddf-96ee-4e91-99fa-ad70bda50bde", "value": "d99f72c298895809260b08284f4b62ed07680b3aef96b6ebf0155e0690bc0835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5c1802-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694067936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067936, "uuid": "f9a08add-1cfc-441b-9c5b-2d023241b788", "comment": "Malware payload (AgentTesla)", "value": "5ce1331ce80b95178b1881fc0d52b784", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067936, "uuid": "580f281e-371d-4806-a27a-2d72a8f40ab3", "comment": "Malware payload (AgentTesla)", "value": "d9a3102e2b9d8b9e57e3a2f504464f1e364a800538dbd176abc9e45b0fae5ba8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067936, "uuid": "443b7316-f9a4-4532-8ccf-89053071aa11", "comment": "Malware payload (AgentTesla)", "value": "a764ec53316ce4267d087015948e201b88b49a76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067936, "uuid": "a09bb5ad-99e8-47d3-81e0-7a3b18b2df5d", "comment": "Malware payload (AgentTesla)", "value": "ebecb4a60127c826cac509b08cd792e58558fc2ab811386feb5027caa80b394bf5d86556b65b744ea4debd50f9ab779e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067936, "uuid": "71c251fb-7e76-411b-9b5d-ded6deee5812", "value": "T1FC5559CA5DCCBB82CB0946B7EB52F9FD493BEE0D558024863032FA4A293315D1CB6579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067936, "uuid": "81d347bc-ec9c-4fdb-a2b0-4614cd3c8e8c", "value": "24576:/WQmmav30xSZyHw6Ve6NCW4Zyew6Vt6NCfivSbNQsFIBe6Haw8aU:uQmmQ30676VfCK6VIjSNjFR66PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067936, "uuid": "a8fcbb71-20d3-4aea-83bf-57e369949ba8", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067936, "uuid": "1a639176-b07d-4625-a88d-da3e02763882", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067936, "uuid": "42101b1c-c02f-476b-8038-d6d5929e06f0", "value": "DELIVERY INFORMATION.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c637462f-4d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694094744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094744, "uuid": "1459c8df-9280-4c77-819a-810520091671", "comment": "Malware payload (AgentTesla)", "value": "034c9c254077048f9b5b01f3d15fbf09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094744, "uuid": "d362f22b-4859-4987-972d-17b6b305191b", "comment": "Malware payload (AgentTesla)", "value": "d9a9294ad07e85a2439e82299dedd31043e00c2c302421cd03ca37a28f329925", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094744, "uuid": "e1f23eb1-4b87-4480-a960-cb929fad2f69", "comment": "Malware payload (AgentTesla)", "value": "3c0338c8f03a08b2afe7103c3fa90036ea838f05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094744, "uuid": "62d659d8-6b0c-4b92-be1f-22ba2c8a9295", "comment": "Malware payload (AgentTesla)", "value": "b91323d06798a86b4df2d66fde32564a715bf061fd1f0f2594f7a855830be953da24b6fd525c22a1592d7d933221072c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094744, "uuid": "b4faf0a9-ed4f-4797-bdd5-5c4293a363e8", "value": "T199341F177E48EB15E2983D3BD6DF2D2813F2A0C70673860BAF48AF6525412436D6E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094744, "uuid": "d468adb2-433f-468c-9f9b-ce65eef716f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094744, "uuid": "1b31d4d1-a2f8-4434-b296-52e9a8c43047", "value": "3072:UpkERq0M8YKLrQqWSIzB1+ynaW32hn2x2idB4vBr:UqERhuKLrQzSIzB1bBD2iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094744, "uuid": "064d4ba5-0803-467a-b83e-ad6cd7a8d533", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094744, "uuid": "d899201d-a155-4cce-8363-9e4fefc12ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094744, "uuid": "21529b04-3e61-4d01-98f3-b1fc48094e19", "value": "d9a9294ad07e85a2439e82299dedd31043e00c2c302421cd03ca37a28f329925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fb713a-4d96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694101807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "6ca956c2-7cf4-4af3-91cb-71fe666f4cee", "comment": "Malware payload (Mirai)", "value": "e8fc5f81051750a0e64c57fddcde2790", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "cf4caa7b-1321-4614-b7b6-582228a0fba0", "comment": "Malware payload (Mirai)", "value": "da2fa7ac79824aef80e623be3df01a459a7615cb20db5d3bf1e50b26dea50f5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "8f816f45-1199-4099-a9ba-a6cda0b831ba", "comment": "Malware payload (Mirai)", "value": "ce5fb8468fbabcb5af7f372ca531a1c7bc6ad159", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694101807, "uuid": "ab8bfed6-fcfe-4259-b8bb-dd63b38cf297", "comment": "Malware payload (Mirai)", "value": "85ced29cfcede0114c2e0b11f2de2d6fbedca523efc5d2bd8a21f5c925fcae4642f2128ab64aceeaca60f6eae35b4944", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "68e93f70-55b3-493d-ba10-1fbc37bd4a0e", "value": "T13BC2E1645228C472A1B05836FDAF41036B36CEF8C7EF323662144335E08BD16D6B5B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "1f50ff2c-7e76-49f4-a603-482eedbe318a", "value": "768:byNUQUfhQllxlaH0MFjlOnGsLGos3UozF:byWQUKljlEDt8GHdzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694101807, "uuid": "5f0dc31f-c7ee-4f17-bb63-672f0cf685f1", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694101807, "uuid": "4d18f02a-ef1b-4a08-88b5-1c3fc9ec6efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694101807, "uuid": "a1cd5e7e-dd36-42de-ac14-9a7015e4c69e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e79236-4d27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694054230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694054230, "uuid": "f30843f3-6d60-43c0-963f-698721b8ef9b", "comment": "Malware payload (Loki)", "value": "95a0babb6d5ffcef8a13d6092412550b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694054230, "uuid": "9b10d188-baa1-46e9-b721-3f92ae69e911", "comment": "Malware payload (Loki)", "value": "dac2900262654e1c4c4c083bad98057b37d7f82e32e75e45af0a4f4fdd174ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694054230, "uuid": "f6b9f9c8-c56f-4599-856c-5791d2dafcc0", "comment": "Malware payload (Loki)", "value": "bf6ee52f1ee9096f30e368754bdfb47a992c6d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694054230, "uuid": "af9ff84c-8ef3-4e50-9712-0d1175969d23", "comment": "Malware payload (Loki)", "value": "367b7611d7cdff9af11af4684e76f05fccfd30e149b53a07a1fec97c5fe85f78a30bd717c5952d00d2da14568102232d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694054230, "uuid": "22b629db-f8c3-4312-9681-5a03152aa86e", "value": "T15FA42319754A0D3BEABAB6F7464012C62BBED3173081E5CC0D5373D289D8BE90B5396B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694054230, "uuid": "10246dfd-262b-4d4d-8d23-097cac288f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694054230, "uuid": "c0e90870-0dcf-4bae-904a-280289922095", "value": "12288:/Kb9Og3bB+/vky0ut1+mF8E1WuLk5fVsbR:EdB+/My0idPwtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694054230, "uuid": "1acd3abf-7c47-4b2f-a5a8-27dff4d6a52a", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694054230, "uuid": "83af10eb-9c76-45b2-ad1c-2e77be60b998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694054230, "uuid": "51a2de1f-7231-436d-ae0a-138d7d4ce0d1", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a66dfbd-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1694067961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067961, "uuid": "690de0eb-b97d-40cb-b25c-ad3571996ad6", "comment": "Malware payload (ArkeiStealer)", "value": "875e3e6aa2c29f4d0d0f7db26e84cd4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067961, "uuid": "af7b7c44-cd52-4fdc-b66b-4ed4006186be", "comment": "Malware payload (ArkeiStealer)", "value": "daf7c331367f70aa3586861539589c08197ecb81a0e4f788a3c6e4949e75531c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067961, "uuid": "3e267cd7-7e0d-4f13-ab37-196fbc73ba25", "comment": "Malware payload (ArkeiStealer)", "value": "6f2e81476504aae1753df60b32dbc2f1863f3a2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067961, "uuid": "ae6d518d-f7a0-46ef-beb6-2f0a2db8a4c9", "comment": "Malware payload (ArkeiStealer)", "value": "08b001e12dd30f04d83f77d341772c6a9f74a1df5fe7a7f8ebfc12411875d4a18c81944c9a463507b9d4c02fce9d3510", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067961, "uuid": "e4c0cf57-5c10-4325-ac49-97de1d50c4be", "value": "T1A294D013A3D2A871E6274771DE6EC6F82A2EB8A04F1566DB27654B2F0DF01E1C633315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067961, "uuid": "297750e3-7926-41dc-a904-2148ca313221", "value": "927e8ee399146237468353308c6002fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067961, "uuid": "65a1692a-8162-4bc0-9c4b-0e6412679771", "value": "6144:/w+p9ujuqHDqz50YKGKL4bV/Cm1bj7F8Ogqkoi7xHxKPz4SvVdgx9:/b9dqjqzn/KqbbjCOLkoIxUpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067961, "uuid": "b8f791a4-95a6-4886-92bc-4180ad97bed4", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067961, "uuid": "a8a60329-a01d-43a8-b129-48b95e4a6a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067961, "uuid": "b64801ed-7471-4df9-b74d-0a37a47e2ae2", "value": "875e3e6aa2c29f4d0d0f7db26e84cd4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d827f00-4d7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1694091025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091025, "uuid": "13cd879d-9d2a-4ed2-bf93-2dccc67bcfba", "comment": "Malware payload (AsyncRAT)", "value": "360a745814db5a66b4aeb66bbe6a8910", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091025, "uuid": "15121635-fcf4-4619-8643-0762545cc170", "comment": "Malware payload (AsyncRAT)", "value": "db0263afaaa9962f0cc8404ca574951a600c47bff12520f2919057dc1e93d86a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091025, "uuid": "6c4a803d-ff45-4f27-ba34-6c551cbd5c30", "comment": "Malware payload (AsyncRAT)", "value": "4c819e6ddadc728765b7d8c6406d433538b9c2ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694091025, "uuid": "b8a00c4e-7491-444e-8533-86cee14be92c", "comment": "Malware payload (AsyncRAT)", "value": "16edf6025b91cef3a1c84fc6fee767c4355cffe195877fb25929ee09541d741576d23e74ef75ddd0ff056eed1f2d4d90", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091025, "uuid": "0f993b57-1016-4b72-b0bd-2123e85c0004", "value": "T1396309053BE8812AF3BE8F74A9F6668446F5F56F2D12C95D1C8501CE0532B829942FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091025, "uuid": "0d4cab00-4d6e-4c79-b01e-b38d59e4f237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091025, "uuid": "231f9cc8-d879-4b6f-95ba-d740111ba7b8", "value": "1536:TmfWSqHdykrVMKuJUYFbtRWlT0iQfbHrR3KdLbfLYJJUrPlTGlx:TmeSqHdykGKuJUYFBR6JWbHiLbfMJedM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694091025, "uuid": "89bfc342-2a95-4d2b-b398-b59141db7e86", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694091025, "uuid": "5395bab8-b316-4149-82c1-6e2b57468153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694091025, "uuid": "c57c0ccc-7d72-4f67-9471-5b8add1f9e68", "value": "360A745814DB5A66B4AEB66BBE6A8910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10d00dd-4d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694050578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050578, "uuid": "3e309a94-4d95-46b8-998c-565f3874eeb5", "comment": "Malware payload (RedLineStealer)", "value": "05444e760188fce800076963a6a7ba25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050578, "uuid": "cff0906e-8ea8-4d67-a039-33a43ac98070", "comment": "Malware payload (RedLineStealer)", "value": "db57f0ca9ed05c3ea9168edec891cf155bd6e054a004520cb27a2caf25804665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050578, "uuid": "6c27d441-df00-4ecd-9ba3-650fbffca674", "comment": "Malware payload (RedLineStealer)", "value": "e09c4960ab794fe39d138b3a49d50c0610263a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050578, "uuid": "76ef8f54-b1da-4925-852e-362ff0bd20a5", "comment": "Malware payload (RedLineStealer)", "value": "85ca7f542a9e3ad27ee409d230abd446169209092400f0c2653b433f32a8ae324267a1f7dc9e19cf84d81046074d0efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050578, "uuid": "c25df5c4-5c7f-44c0-ba17-6b27c71dec7f", "value": "T1A2C41212A3EC8077DCB41B705CF607D71E39BC619D78936E3785A90E1872AA1A47632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050578, "uuid": "efbb046b-14b2-4616-90e4-bd3fb1c5a8a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050578, "uuid": "1f65da5c-5d4a-4c46-8258-b440ad8e61a6", "value": "12288:rMrky90Kn2BCETKFNymJUXNoY9YeeGKblN9jYah1MStJk:7yj2zTU8mevaeeGmN9jHxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694050578, "uuid": "a7f80a73-a4d7-465f-88b8-42e03c65ebe9", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694050578, "uuid": "7da01113-2d5f-44d0-82ff-924c62b05b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050578, "uuid": "ece0cfc6-8ca9-44bc-9e54-7265f23a4178", "value": "db57f0ca9ed05c3ea9168edec891cf155bd6e054a0045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56530d51-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069216, "uuid": "7d1ea668-7a6c-4724-907d-3b38ffdf1eea", "comment": "Malware payload (AgentTesla)", "value": "9cbc0b936f302c3e1d3f14d56a41d7c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069216, "uuid": "0902d492-e418-4994-bc42-4512bb30e7f5", "comment": "Malware payload (AgentTesla)", "value": "db604e87813d78254ad31ff37943e58df66714b5b9df25590b4055730c0a65fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069216, "uuid": "6cee1b68-2ac5-4930-95d1-0e3a0c6da77d", "comment": "Malware payload (AgentTesla)", "value": "2ab4b635fed214a4833c89ce82bc3cb709a712e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069216, "uuid": "8ece3f38-25ea-455e-87d6-77cf2b323c52", "comment": "Malware payload (AgentTesla)", "value": "ee97c116d61db15bb112f5afa14674d0742843a6ddd3ae1267a4d2146fa55d186cc0e9a2eb2c78f989ad570646cdc48c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069216, "uuid": "7fb62215-0dcf-422d-aa72-9899dd00fb2b", "value": "T1C274C503BAAA89F1E3881F37C596544417B6D6C273DBEB2B748E23A9440376FDC29507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069216, "uuid": "3ddc2823-1f0b-4901-8df8-bc61e9dcd862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069216, "uuid": "e434eb96-a822-4f04-a5f4-ab591609a1eb", "value": "6144:4ePrGVBEBDHg/hcTa87Ck/mHvIB+Z4JuMbbrqnJ1a4ZsbSjRxcD322miXHSYu2Wi:4uqBwIhcbycummJRxCbSYu2W+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069216, "uuid": "5bb8e878-8190-41e6-a871-5239e490bae8", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069216, "uuid": "dbaf1895-d8fe-4cf9-a616-72f311cc9d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069216, "uuid": "dbd50879-e38a-4c97-bc8c-f973d244d8f6", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf____________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb7e564-4dad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694111613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111613, "uuid": "a6778249-3b7b-4123-9932-724f189e871f", "comment": "Malware payload (BumbleBee)", "value": "7d2d9f9e62776b81ee4bdf6ed3f83e28", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111613, "uuid": "111bd0bd-888d-4379-9aa0-4b53afe45eae", "comment": "Malware payload (BumbleBee)", "value": "db74a365daa5f1f7c6da4a6a187faf7dd6e77d9ab654b145e31480bc53b7ea0c", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111613, "uuid": "8fedf682-8db5-40ec-9643-6b2fd6a331e8", "comment": "Malware payload (BumbleBee)", "value": "b35e23c97c6cdb579f8c2f2d3be7f56c770c262a", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694111613, "uuid": "1decc353-93e1-4840-8125-63a6cb22a299", "comment": "Malware payload (BumbleBee)", "value": "6872ab9c3cd87e81920f0238b85ce71d9f69c96212798ec96c147f0501d64d23a81c84cf5c501fba4d0d98e7ee66d3a1", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111613, "uuid": "e43b633b-1ba5-4439-ab6d-5ca49c912549", "value": "T1B9D4C08FECE1FFEAC85D11B6C88E02AD56A3A6406E06093BA56D025931D3B0373D775D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111613, "uuid": "766fb046-f5d7-4d42-8bb8-04946e69af1d", "value": "7e5590227ad3aecb2feedda5da4da1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111613, "uuid": "2127aac9-d0b6-4da4-a003-2df7ca87c89c", "value": "12288:/gyQHOM8AyCxQv/x1gQrEb0f8wShtqDA3XNaMxxdAmzR9:/gToCUDz4twShtqknNVhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694111613, "uuid": "a080fede-fcea-4406-b7e6-4673cb1e76ff", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694111613, "uuid": "941f52d8-5094-488e-874f-84c0d736103c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694111613, "uuid": "7ceb46c6-3ed6-480b-a808-f6b43e6296c9", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0377b094-4d24-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694052756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052756, "uuid": "cf4ab617-3105-4d8b-a93b-4d682c9685a4", "comment": "Malware payload (RedLineStealer)", "value": "f8d556ba88ee619b0b7d61be517ba3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052756, "uuid": "7eaf562e-b7e0-4097-a3ba-45e1a6c0ca89", "comment": "Malware payload (RedLineStealer)", "value": "dc653cbb39b344abdb807795a1f2da0533d61c4de6eb432f9c98f4c522e82c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052756, "uuid": "da3d9a9c-a11a-47c2-96e5-8cec2776b0f5", "comment": "Malware payload (RedLineStealer)", "value": "4ab6f91d7f477853c9b04f59dbb580514d91ea97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052756, "uuid": "e73eff13-e234-411b-bb51-e66171378958", "comment": "Malware payload (RedLineStealer)", "value": "4722632c7aace1e57b46f652980a04316954bdaebb206ce8b074b2c5e690c015829286226697964542c2fd45b1fe17ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052756, "uuid": "fca69db3-a3ef-495b-8e2f-235a52fe7dbd", "value": "T194A4D112B3E1A876E62306B05F2EC3F47A2EB8614F55F6EB17544A2B0DF01E1C572329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052756, "uuid": "f46d886b-a287-4722-b3f1-6f83df99bcef", "value": "4905c16b56c6c2dde9b3bf949bc04295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052756, "uuid": "f6f64e63-df81-4248-8492-53a0f44d48fe", "value": "12288:TnPq8+uhqA02BPIIMhEvfTNxLXUgNUtzSN5:TnPqWhq+rtTEgNUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052756, "uuid": "62d1180e-fc1e-4308-ac83-969097b86d0f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052756, "uuid": "64ac5b9b-c5cb-43d6-8983-62b45e9dbda8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052756, "uuid": "154c85ec-844f-4492-96f8-f57e768adcd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d2e27b-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694067918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067918, "uuid": "e461c410-9f7b-4a3b-8b01-291aa9d79cb9", "comment": "Malware payload (RemcosRAT)", "value": "c30c4ad198638cca64573872aeccb75c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067918, "uuid": "99f0a344-2b9e-41a8-a7a5-694cf1f835d1", "comment": "Malware payload (RemcosRAT)", "value": "dc802a3ab49c4c46bbaca5f0419e6631919ede3f119509e0b3255e88553ce831", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067918, "uuid": "cce8c75c-1568-4d60-a90d-87910666b72a", "comment": "Malware payload (RemcosRAT)", "value": "c43574e3cba99d3553d9d57b33acb34a503a4cc9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067918, "uuid": "117d501e-31f0-472f-8c19-3d9e50db989a", "comment": "Malware payload (RemcosRAT)", "value": "7e55df959b0b33c18cf26bb0dfac91813a138f58fbc7db24d732feea73f259e82e4f56df7c04bf5ff8ab50152afafcb2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067918, "uuid": "8bc0eb9b-7dd5-40a1-8cb4-c1ccebf2f40d", "value": "T1B9556ACA9CCCBA82D70842B7EB12F5FD197BFE0D958024863132FA4A297315D1CB6579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067918, "uuid": "06dfcff5-bada-42f8-8ee5-96bc71437c8c", "value": "24576:ZWQmmav30xSZyHw6VH6NC6gZyew6Vz6NC7X6GrblQsygR6HqfSwZK:oQmmQ30676VaEK6Vmaljy5HqKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067918, "uuid": "73f63a0c-f715-4e1b-ba99-5a5aae073ca6", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067918, "uuid": "bf907982-e7d7-4e52-b069-59d38eaad939", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067918, "uuid": "6d295eac-ed48-4d02-94fe-1f3c3a40eb6f", "value": "DELIVERY INFORMATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d06bdd0-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081361, "uuid": "fedd9e52-f649-4e69-a3b2-aa9d2ce9b37e", "comment": "Malware payload", "value": "41aa836924ee4a94bdc75fa889e37184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081361, "uuid": "a05a74ab-b86d-4f04-8ac6-74c948022211", "comment": "Malware payload", "value": "dcb35eab5992bd212220a82532b97029a06e124f9c6320e1560f11d15ff4384c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081361, "uuid": "a217a815-580f-463c-92d3-e2d4f1f6bd16", "comment": "Malware payload", "value": "4641174859bfd7cf7f289a5726fb7af241980c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081361, "uuid": "d674a62f-f024-4fac-8a48-3c0822d3aa37", "comment": "Malware payload", "value": "c4ec5d71a6aeba673465bdb52f0091764de80d5fbf48cbec8653a7afdf363d451d159d97b177b4ec58fcfc1d84e21a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r77", "colour": "#FDBA5B", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081361, "uuid": "3436d419-8545-4209-885f-5e7d7521ddfe", "value": "T1433413A0EF6E51F1DA6D9333D9301502A524E5830921B67EF2DC40BEEA7A0CF9CD1B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081361, "uuid": "ff3109ef-224e-449f-93c2-04cc4560fe55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081361, "uuid": "b4cfe8ef-7bda-4e3c-b8af-9501fc3a388c", "value": "6144:eguKBmmlbvx0zKGkl5EiCtuhNjtANJ4tDWhRaitlopY:aKNJVZotuhNZKxrYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081361, "uuid": "021254dd-f912-42df-8c3b-569db97e5dfc", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081361, "uuid": "f650d9ed-b31b-449f-806a-1bd8d9733179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081361, "uuid": "b35f89b5-2fb5-40c7-9d50-4feb521ce9f4", "value": "InstallStager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1a6c7d-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cosmu)", "timestamp": 1694084745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084745, "uuid": "b39f2749-8805-48bd-bd13-090ef3f78938", "comment": "Malware payload (Cosmu)", "value": "f63aeb17b7a55b59e3abbe06003d91a5", "object_relation": "md5", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084745, "uuid": "bca8b2f0-c12a-4645-9628-5ecf6a2cc04c", "comment": "Malware payload (Cosmu)", "value": "dcd454a07cfba7a348d0f2fac76c602a7cc76e39704bcba45df1f461b7512d40", "object_relation": "sha256", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084745, "uuid": "734d844b-983c-4b0b-9b5e-ccbe6f440199", "comment": "Malware payload (Cosmu)", "value": "788ce769f7aa44d6a29d94f830bf2b9b54662daa", "object_relation": "sha1", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084745, "uuid": "b3eea0d1-72e7-46d9-b884-457c9e3f8bf2", "comment": "Malware payload (Cosmu)", "value": "e5e619adf6b3887ae1beedfcae5a430e64a5d3c9d8f585e178270f8bf19a3e9482a76246e7fa4a79da3454d874b48410", "object_relation": "sha3-384", "Tag": [ { "name": "Cosmu", "colour": "#5589AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084745, "uuid": "48e6ccde-d555-4ae7-b8fc-0d705dcf4144", "value": "T17744126827BF150FC43804F11616B6CB757CEC17983A15BAC6E0A81B3EB071B985B7AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084745, "uuid": "d97ca72e-c8a5-4ae3-8662-caaab8449b05", "value": "3e3d633779e35448851e7a9ca7e72522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084745, "uuid": "8356fa56-a472-4049-a3ff-2f910963f082", "value": "3072:GR4jdNqTqHLklZpb4RrRDFBI/cMrnTS4y3NkEjbvjuC8xVkxRQjZ3phRrbhogmQ+:AafcEHI/prnm4y3NjTjuC8xOcxphLmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084745, "uuid": "4d47472a-9f6d-4276-a880-3684369757bd", "value": 258517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084745, "uuid": "0633912f-4526-49e0-aa3f-698d76fb9864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084745, "uuid": "d0901829-8164-4969-b421-62e79cec57d4", "value": "Virus.Sysbot.ATA_virussign.com_f63aeb17b7a55b59e3abbe06003d91a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80454ef7-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122115, "uuid": "41f14d75-6887-4ca8-9db1-89f170b73630", "comment": "Malware payload (Mirai)", "value": "8aae7cc998083f6f6c446a8f422a65bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122115, "uuid": "dddd3575-1003-41c4-a064-366fe01178b1", "comment": "Malware payload (Mirai)", "value": "dcd6c1ee267264fdc2088f47722092af7b8443d314a8a6264d6682904f697176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122115, "uuid": "d91b881d-08c1-44b1-9988-8f070c55c531", "comment": "Malware payload (Mirai)", "value": "1420463065e9a71068078b12f5eb3f1e09bd78a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122115, "uuid": "505c9f7e-fb69-430d-9b53-cbf5f4ec2416", "comment": "Malware payload (Mirai)", "value": "51e6d5a4971a15556cad8b12d581ee2420c7f009ecf9888d38a0a805e8fbd9969ade8ff85fb7c296247e3d28d40adc14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122115, "uuid": "f0a2136a-4f1d-4836-8909-5d2a991fc622", "value": "T1CBC2D044F041DE41DFEA28B02D50DADBFBA16F1F6A528E8126A123D15E5D3A74345DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122115, "uuid": "0227402e-f054-4fab-9466-0d8c96a650ae", "value": "768:IVdafO76jpmNJJKehmA7trpfIX9KeA7Pp04uVcqgw09M:4am+AnKehPRa9aB04u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122115, "uuid": "14615ddb-3f66-4b1f-aa92-03bcb43284c9", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122115, "uuid": "322b502d-eaae-4974-8720-38bc867a5e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122115, "uuid": "221d67c3-6c66-4b13-bb8e-fa69a2bbf821", "value": "8aae7cc998083f6f6c446a8f422a65bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620276e0-4d89-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694096294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096294, "uuid": "549a8454-0c41-4909-a42d-8a6959e18ff2", "comment": "Malware payload", "value": "1c8619a0dbea6a34042e59c2624ce428", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096294, "uuid": "0536b4c7-af6b-4038-992b-03692c8d0214", "comment": "Malware payload", "value": "dce7d75d4c509c91b72d6966cf066034c16963577b6e04e96f0679df0452c11e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096294, "uuid": "9d0b8c73-e9a8-4695-aec2-0f299ba0e0f0", "comment": "Malware payload", "value": "c0f8625263857158864ac529e737fe4f909c3e7d", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096294, "uuid": "465bc1bc-d5a7-4bfa-84fc-e6195f34ab22", "comment": "Malware payload", "value": "f22f841829fa80026190b3db9bca436cf8ab10dedd65559a7500fd36de43885888325d54c2d183e480aef1558b769ab5", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096294, "uuid": "98f56d1c-1800-4fc4-8feb-1eeff3d8dfe1", "value": "T18B4194F5F717C1C44472A66BDCA7D089AE7880690021150A7ADCCCDBFBA1E605272F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096294, "uuid": "e704ae2a-ef7c-496c-85f5-dbc15f5619de", "value": "48:8ceg0JDKkkHr1Vje11Z9IYb19Z/cPFFpgfqpg4:828KfrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096294, "uuid": "6f4831fd-93ed-4fc1-ba3d-0ead565e8d16", "value": 1955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096294, "uuid": "7d810861-abb1-4e02-a620-670e7b1f0c3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096294, "uuid": "da2d7172-3f74-4254-9e59-6667f7ec4e70", "value": "dZrXXaxS.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cf4185-4d5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1694077434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077434, "uuid": "d1df9cd9-464b-49d9-a7df-b6a7afea9c8b", "comment": "Malware payload (Heodo)", "value": "e904c92f5aa71cb4ecfd3ad6ab7aee76", "object_relation": "md5", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077434, "uuid": "c21a5606-9f90-4a13-a8b4-59369f93e6b4", "comment": "Malware payload (Heodo)", "value": "dd01e65fb09f159502fd2339d3593cb93e6be2b696f5564d65bb0c329094544c", "object_relation": "sha256", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077434, "uuid": "086c4f1a-1400-4282-b6aa-9611886cd529", "comment": "Malware payload (Heodo)", "value": "5767b223b549808f500740c8e182dd10ae23698d", "object_relation": "sha1", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077434, "uuid": "68df5060-cca9-448c-9b44-6b3234080989", "comment": "Malware payload (Heodo)", "value": "5c51af95dd4546d138c955550270ae34f53eb9bfc469cd328e6cd07d996bd46f753ccc8dbd18532770e9c91c53a2dfec", "object_relation": "sha3-384", "Tag": [ { "name": "247info-click", "colour": "#D5F7FE", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077434, "uuid": "1565e9bd-d960-49cb-923b-67f6c784a884", "value": "T1D1D5012132E8C529E2F71B38E93A95F16939BD24DA23C10F53647D1E2971E808A77373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077434, "uuid": "a224471a-c664-4751-909a-22f0d5e07163", "value": "49152:kHEujqkV51C7XRLxxfhLdEP/d4dYdJS+G4IN4O3T4tL+jw/q5HRw1g3:kHEU5KXRVn2nOdYds+G3IijwiJRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077434, "uuid": "6613d9a6-7887-41c6-932a-02a87366aa52", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077434, "uuid": "abe19a6e-07c7-40a7-b704-59473ce96e1b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077434, "uuid": "ffd29ac9-0d7a-4599-b320-c6520855d44f", "value": "Screen.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea4e2bb-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075753, "uuid": "cf63939d-29e5-43a3-b573-0a120448e295", "comment": "Malware payload (ConnectWise)", "value": "d2524262aded090be1955a8c4b66bebb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075753, "uuid": "2470d01e-4c0e-460f-a8aa-a9d322fbad48", "comment": "Malware payload (ConnectWise)", "value": "dd141dd7d34b1d423a3a8c68d66465dcf30505b2dcde432d512baee909ee5244", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075753, "uuid": "25e00b03-9e35-4d22-8e21-90a7cd73d25e", "comment": "Malware payload (ConnectWise)", "value": "01fa5e05933c5b3e34579399a56e6cfe5ad7ae32", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075753, "uuid": "676d1c8d-16b2-46c5-845e-44992971e5a6", "comment": "Malware payload (ConnectWise)", "value": "46cc79f5d40ac6749d4ae5958203ed43b63fc7dad46ae9fd6049f080a76eb438cd2ff88f057ec973bef2fc7dbbdb1141", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075753, "uuid": "88e04a8e-5de7-4a0e-8e8d-265f598bbc3c", "value": "T19E836B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075753, "uuid": "694bd274-fa59-4430-beaf-7ab0c3fbe2df", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075753, "uuid": "06653b66-75ab-46aa-8ec0-39e93a2b1200", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Rk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075753, "uuid": "48be34b6-52b9-4f2f-9695-99dafaf0c2cf", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075753, "uuid": "802f9bd9-e879-4fdf-9b8e-da02f33afc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075753, "uuid": "ee98939e-5299-48db-ac44-bf90af266981", "value": "d2524262aded090be1955a8c4b66bebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e5657-4d65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081054, "uuid": "1b1601bb-121a-47c5-a0b3-9fc1771b1bf3", "comment": "Malware payload", "value": "66a0146f153de2829325468f4d459650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081054, "uuid": "a3f6263f-6646-4bef-8c6b-3be60fd529c7", "comment": "Malware payload", "value": "df32013fe460882766191e066ecd45ed434dee1edc6b3c2fc574fe2486095909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081054, "uuid": "f60dbc0a-0cd8-4b7a-935a-86eb0907425f", "comment": "Malware payload", "value": "7db9a9d6816ebe22ced165229c243ae2e9776989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081054, "uuid": "d756e244-1e6a-4f31-beed-3bf95e3fdc24", "comment": "Malware payload", "value": "d423c8c1ce0f344f60418a1bb2dc17fcf861fae995343a68f4ee0f1e9a4c3a1d4ca01cd9060ec6edf414edf8defa4856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081054, "uuid": "ef232b83-81e8-401d-8cd8-8b4d2d56386b", "value": "T12343FC9D766072DFC86BC8768EA82C64EA60747B531BD243A01316ED9E0D99BCF150F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081054, "uuid": "8a60f267-fd56-46ac-a547-5535d24b2b59", "value": "1536:4+ncAq6jijXoTHjHeURbOqt3Pb127Ng/+I:nPijX2Pb127Ng/+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081054, "uuid": "3f0153cb-c4ab-4bb8-b3d9-5874f02439bc", "value": 57784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081054, "uuid": "7b535748-a870-40fe-adc7-9088596656e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081054, "uuid": "3f22266a-0112-4bb9-be49-811bc823ab8e", "value": "123-watchdog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bac8264-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069252, "uuid": "91b13d88-30b9-4b34-aef2-cd6a840ac367", "comment": "Malware payload (AgentTesla)", "value": "d7398628dd5135f9af7c5d35b9896472", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069252, "uuid": "f69f43e8-ba63-47a9-9529-2745ac707ea6", "comment": "Malware payload (AgentTesla)", "value": "df452be70ac2bb46b5199bd02967fd58f14e2b5421771831e13de65aed1cabbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069252, "uuid": "82142a98-8f18-400d-9a9f-7a47aac931c7", "comment": "Malware payload (AgentTesla)", "value": "dd001fa2d22201d36ff4f5ef30ed80731b3e3c35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069252, "uuid": "1eae2638-5cf2-4a6d-a922-46b0b5da6edc", "comment": "Malware payload (AgentTesla)", "value": "7f5897a23836655f84ff80691930742c1e0a699164f15d5c4a13ae25c5b7c95c0c8ae5a2ccdd59426a826357d994ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069252, "uuid": "ed7cb46b-a225-4bc4-8e2d-47685f9b9545", "value": "T18AE423E5BA8B93B28ACA6DBD580DFC02C354B390E4A9F3054B7A8DDC8F1837E1105756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069252, "uuid": "9555bf50-c4d5-4e8c-b15b-29c198b73157", "value": "12288:aCe6IWOh1DDfwuF7etcxxL6r9sD4DFT8pF3kdhtuf60bd1dL8D7ipybBV:aqO3DD1F78cHwsD4xTAi4f60ndLocCBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069252, "uuid": "ef4fd704-689f-47d8-9e2d-da4a50e238fd", "value": 679992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069252, "uuid": "1860457d-97b3-4a3d-b190-345eded98177", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069252, "uuid": "b22b02a2-e959-4ec1-9cf5-6b84f617ef43", "value": "Orden de Compra098.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2fe976-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067916, "uuid": "2b1d7fc8-970f-4841-aeeb-bf167f78f496", "comment": "Malware payload (SnakeKeylogger)", "value": "4936187fda0364ddf344c6db57f40074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067916, "uuid": "6ff03b04-1502-4edd-9f99-22fbff376a43", "comment": "Malware payload (SnakeKeylogger)", "value": "df8944cca7e607a5fe6765794fbd8c009de24cc170a99cd0cb7055b177b6a217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067916, "uuid": "438b5309-c7b5-43f1-ae94-cd34fbfb09ed", "comment": "Malware payload (SnakeKeylogger)", "value": "d441b7ed5fb69ee9b866563511358a7cf1cc03b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067916, "uuid": "165d81eb-4300-471b-bc5c-60075b15cdfd", "comment": "Malware payload (SnakeKeylogger)", "value": "19c819abc6bf64c60490508d8b0bfb78bc22832414c63ec68f99b883bc4f9589374b73e0d3348efce94641bd32b5fc18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067916, "uuid": "b0cbc719-037d-4454-8c30-829e58f14d55", "value": "T132155DD1F190899AED6B06F1BC2BA53015A37E9C94A4C10C5A9AB75736F3352209FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067916, "uuid": "706fb690-d6fe-455b-b861-70d0ff8acc0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067916, "uuid": "5379a371-aab9-4745-9b8e-a979949a1e71", "value": "12288:a3s2iNHkDwMD8TcUQeVLHZ0y4Qf52tn6vgvys+STxmGwyh5bwkXGQ4d:a3s1RkDV8MU54Qf5M6vH+b3h5bwkX8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067916, "uuid": "88896f5e-4a3c-4094-bf80-319d403f1adc", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067916, "uuid": "5cceb6cb-3192-472e-88b0-8a69ad113867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067916, "uuid": "64054194-b466-4b97-85b4-bb332afd9b42", "value": "SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf71d839-4d21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694051783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051783, "uuid": "0698fc7e-e9d1-4256-824b-89121e4b11be", "comment": "Malware payload (Amadey)", "value": "44e6378a63f044ef47f590f58b5a9dc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051783, "uuid": "bf3efadf-57aa-4588-9853-8d644220700e", "comment": "Malware payload (Amadey)", "value": "e0b3551628115659dcd3ec40ca5d2c09993d80c5dd8e0d5a527a4e8bd0644138", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051783, "uuid": "bbf729d3-3bb7-4845-bb1b-a9a0a9ec2839", "comment": "Malware payload (Amadey)", "value": "690846de69ac5ab9479490fb4f2e4d3eab05d830", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694051783, "uuid": "1d56eca7-788e-410c-992d-1ceb5ea810d3", "comment": "Malware payload (Amadey)", "value": "4d8a12af0c242520de4897a01ec2210ed93e2bc3c91ba903d090fec70a1e2d2f321a86c8ccb54ee341d1647434b774da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051783, "uuid": "e5fd173b-72ca-4628-8ea5-d6b738913d12", "value": "T15724F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051783, "uuid": "b696616b-b0c2-4587-b1ae-22a4d42ead72", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051783, "uuid": "a1144e95-de7b-49a7-9e4f-79d48ad5b927", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694051783, "uuid": "0634f643-7cc0-4ee3-989c-b1a9e22defa7", "value": 225520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694051783, "uuid": "afc796e8-c70e-4396-99d8-8afa200bca34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694051783, "uuid": "1bfbce01-30ff-4498-a1fc-7903628c8c06", "value": "44e6378a63f044ef47f590f58b5a9dc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae5109-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067871, "uuid": "5c0bdb00-d477-4e30-81cc-c0ed6f11d708", "comment": "Malware payload (SnakeKeylogger)", "value": "49aa2c025973240e26b9714f5891ce84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067871, "uuid": "01bb2a9a-4401-4fa9-b70f-04d34da09612", "comment": "Malware payload (SnakeKeylogger)", "value": "e0d2da94bc066097294b9d0736e1a3aee8a4e10f667f33ef191938004cfa9d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067871, "uuid": "f1ddf75b-dede-4823-8730-502a63f95426", "comment": "Malware payload (SnakeKeylogger)", "value": "92929f1f1523deed1d4c858d5e552033683e0312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067871, "uuid": "ab406bf2-ea0e-4b6a-bdef-fb6eebea8f98", "comment": "Malware payload (SnakeKeylogger)", "value": "8cf941032cca286789741e6cda1a0026088f1b319e53f6893365d17a0cbf13f5e58d742c6e27a870caf4ea4d4fa60e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067871, "uuid": "a0ae5506-2955-4271-a545-fb09717f8e9b", "value": "T1872563FC5CFC1136D9A0EE908ED9851BB1C0A17FF285AC1D97E20B654252A4AF88753F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067871, "uuid": "5fb69050-1079-49ad-80f7-2e02d4e53ad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067871, "uuid": "a9818393-62cc-4d8e-a98f-718b696169ba", "value": "12288:/v1KhSxpEA2uLp5XmeE+KlJypo7FFl6Qu6rq9z3mDoz:/v1KIxi6XXE+MJyWnC6rqt2Doz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067871, "uuid": "b9abb674-a5c7-4fab-9637-ea16023adfe9", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067871, "uuid": "f1f3c50b-7ebb-4c6e-bb4f-99b20259ea75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067871, "uuid": "b9fcb618-ddab-4176-b4c0-b5921024d2c0", "value": "New Oder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36575cc-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119301, "uuid": "ed11d263-314d-4f2d-a6ac-f8a18763b400", "comment": "Malware payload (Mirai)", "value": "db03978812898db67759254aff689bef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119301, "uuid": "2fb135f1-a0a4-4926-bffe-f659086dd157", "comment": "Malware payload (Mirai)", "value": "e1257e638200b27e21467e9638da78acdb2e837561249bdff4f3ae4c962b9180", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119301, "uuid": "c6c0ac5a-622f-4e43-96d0-b4d63f7ed57f", "comment": "Malware payload (Mirai)", "value": "8ee7d389ebbbf414c0cf0a00987058806a562928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119301, "uuid": "a319a145-963b-4451-a167-ac5c3a920903", "comment": "Malware payload (Mirai)", "value": "d73a976751013017c0b7c8ae81ef5aebe4f104c3bbe4ec49c692c611d5d9646172ca675d56c61647162011ef7c7bce47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119301, "uuid": "b88e72a1-7a80-497d-8363-85d15763dda6", "value": "T196A2E029D349AFF4DFAF9D9452C1C3C276E943C7278AC8E340EEAF012506046B789D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119301, "uuid": "94146770-6281-4cac-94fe-1ae56fe05ec8", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5quM4uVcqgw05VxJm:MRxsSVsMD6xiJJE5zRWN44uVcqgw09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694119301, "uuid": "ea8926bf-fcd9-45f0-ae7d-d2f604967e24", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694119301, "uuid": "329fe688-dc5e-4372-a833-adbf54e7e6a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694119301, "uuid": "1e419b1e-27bd-4a62-8688-2f0c82a499ed", "value": "db03978812898db67759254aff689bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0394baaa-4d62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694079385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079385, "uuid": "b4a67f44-fc77-4663-a50a-8b31a1d82c74", "comment": "Malware payload (Mirai)", "value": "a6c08f3362cb4c482737bfda5f023203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079385, "uuid": "fbd64649-7faf-4d76-95e4-0a35dde5e3f6", "comment": "Malware payload (Mirai)", "value": "e1334d2673a10eaff8712caa029f1a0d1cbe6bc20c3895a4250137c7542c14e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079385, "uuid": "099c77c7-0c51-4cd4-b71d-e940a1209c77", "comment": "Malware payload (Mirai)", "value": "a4011ebe9b07771c230f66a9ac7654ec528bca40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694079385, "uuid": "d4fb8973-2659-44e3-8738-f0a4c94d8481", "comment": "Malware payload (Mirai)", "value": "9db604009a3ffa7eee0de7cdddfaa6446362aae54b74c96d922de235759cc0dfb2c65007e5dea3f9c4a204f139af1c30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079385, "uuid": "8fab1fdb-bcb4-4a3b-a666-0ddede69061e", "value": "T1A333F2B367AE6DE152B09377FC32AC5A569C16E84C67309A3CF0561573C58024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079385, "uuid": "341096f4-99ce-4a27-9abf-bf4db498ce07", "value": "1536:d9O/ZMAXIxNUk0UhLcPqF1aBexo4opKZb8:d9O/ZNKyKLGqFUFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694079385, "uuid": "bd1d44d2-fc29-4ccb-a05f-861219023851", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694079385, "uuid": "aea5fe27-2bfd-4ea7-b65e-36ac9684450d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694079385, "uuid": "e24312e9-885b-42de-9686-769e3a4ef2ac", "value": "a6c08f3362cb4c482737bfda5f023203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d87f071-4d9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694104903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104903, "uuid": "4756ce3f-d6da-4fa6-bd86-9faffe2343ef", "comment": "Malware payload", "value": "f7b5fd441abc6ff11703e5e4b532c43d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104903, "uuid": "8bd2fdc5-8356-4aaa-b5ea-87ad87cb53d8", "comment": "Malware payload", "value": "e206f6f1d1f814f0df1b4dc0c309739f35960537c9fd7fc8d1814536c232dfcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104903, "uuid": "ed5cfddd-94cb-476c-a1a7-ac8dfcd0fd2d", "comment": "Malware payload", "value": "1378cbcaa6b7df32df280928e7ee9d11bae07aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104903, "uuid": "ea9e40cf-5dd3-4a92-88f8-8f057504b2d1", "comment": "Malware payload", "value": "d78b2773b494ca25c0d4a07f84b2797ccde7e552a409e606c148006ac438b81ce328b22612e679789ef92b254982adba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104903, "uuid": "a8440f05-958a-427a-85bc-1eef2628aa37", "value": "T1216429B9F1F0DEB7EC621136192076F01E5EE43B0E5CD55B134839EE29ACDE891128E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104903, "uuid": "ae903e82-56be-4053-8817-c21ea4b2d7d4", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104903, "uuid": "dd25234e-229c-4bf6-a873-3c10954c17d9", "value": "6144:SJ6PW79nd1kCh2Eonf5l5RxM9zU2gfwLlSRBDznZ:SoEHkCKUz2sIRBvnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104903, "uuid": "c54332e0-17d1-4408-b5ce-da9bed4a4daf", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104903, "uuid": "a379709c-e216-48ca-a4e9-d45190145eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104903, "uuid": "b6358c18-8514-4120-8ec6-0203ec0b0664", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9319eb2-4d4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694070724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070724, "uuid": "a42dd36c-8ba7-413b-9c59-73b6b6dcca6e", "comment": "Malware payload (RedLineStealer)", "value": "9af17ce85d867e32cd0f8bd49e13cd01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070724, "uuid": "8dd4c9bd-399d-424e-972b-3816d8993c56", "comment": "Malware payload (RedLineStealer)", "value": "e2156f5b9a2d9a54cb14df09130ecb26056819650ac17b0aaf98f94b36b5e283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070724, "uuid": "a7911795-3582-46a1-b982-a4fb360fa8da", "comment": "Malware payload (RedLineStealer)", "value": "448325041f6de9b91c3885664f274f3f68460124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694070724, "uuid": "2d57d51c-4d86-46ed-a324-f6482c69c423", "comment": "Malware payload (RedLineStealer)", "value": "c7fd680aa68150e0767e0bda036264b5fb81057fe79a4105b4a204a8c8020d34784e7b972dd0154a17e0f48dd9ae764c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070724, "uuid": "cc632cc4-c198-4a0b-a7ac-b1174bba792c", "value": "T1E8E41206BBD45073D8792BB05DFB57870A32BDB18D74832A26452C9E1CB2A94A47137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070724, "uuid": "04835e85-c0d8-478f-97ed-0a093b6f92f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070724, "uuid": "7afbf285-dc07-47f5-9207-bb3e110ce6d5", "value": "12288:WMriy90WffC/Fk9Q1ltlKe00ARppBdx6m2HOckYVdv9mI:oyok6tlKeVIdx6m2uZa9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694070724, "uuid": "88f29b28-d845-462c-8745-16fb9e4d653a", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694070724, "uuid": "2e9dd05a-dfd6-4cf0-a903-a87ef860064f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694070724, "uuid": "6f617a54-c2bd-4112-a263-b79d75668957", "value": "9af17ce85d867e32cd0f8bd49e13cd01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0e3f2f-4d3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694064714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064714, "uuid": "5a4eb713-90c5-4f57-90c5-f99b21aab92d", "comment": "Malware payload (AgentTesla)", "value": "9509baa69b227e3802c95e7f68f5d3f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064714, "uuid": "ee188b60-14b6-4080-897a-7f0d5605f7ca", "comment": "Malware payload (AgentTesla)", "value": "e2b5d276a5778dcf5b0e456c751804a30d063feb2da1467ff01fa736179767ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064714, "uuid": "c2409dc3-3060-4107-be67-9296b036cb4b", "comment": "Malware payload (AgentTesla)", "value": "89f4811b09c0115815387fa6945f763ac04a5788", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694064714, "uuid": "b203a285-eb73-4184-b46c-284815cb7e4d", "comment": "Malware payload (AgentTesla)", "value": "36654a78db3327595281f73852e20e1cf56a86f02c04fde4acae0e57ec6306dcf0c3df1c75e5004856f11f470de9eb00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064714, "uuid": "63d4650d-ef53-4e95-a024-10a4401d8ca4", "value": "T1D8D42202A46A6F31E5BC43FB051036C1A3BFA559615DDA1C0ECB21EC06F9F0843A79EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064714, "uuid": "60b31b4d-35ef-4233-997c-788775ee37c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064714, "uuid": "1f930fbc-0eff-454f-aa43-34d7fe13427f", "value": "12288:Hx+6DzFBlLRlLcyAghALDoXD8T3DDLZn0aPiJdxxcIbx5fVsbR:R9rlcyLwoXD+p0aqJdxxcwtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694064714, "uuid": "7a87a851-0e10-4b86-8514-e2d7c3054f14", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694064714, "uuid": "dca0b547-64e3-4fda-9090-fa99c23b6158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694064714, "uuid": "7e7642a1-38f1-4dd9-a4fe-2d3a83a523c0", "value": "SecuriteInfo.com.Win32.PWSX-gen.18511.12792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cbf8da-4dc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694123404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123404, "uuid": "e5180b0c-82af-475f-b863-6707f83dd3e3", "comment": "Malware payload (Mirai)", "value": "a8bbff99252977969239d69b9dd76be7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123404, "uuid": "a963de7c-e50c-4680-b87d-8c9c3c34fe05", "comment": "Malware payload (Mirai)", "value": "e2d36c65a023dfe169773c9a30353abefc580dc591e60e0d357de16fc9606e8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123404, "uuid": "3e7de180-de1b-468c-8fd5-2b2af9bc5da8", "comment": "Malware payload (Mirai)", "value": "418f60274ee8d910ee0cd3ec359798255cada779", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694123404, "uuid": "fc848b01-8b1d-4678-95d2-cbf1460da987", "comment": "Malware payload (Mirai)", "value": "d03f2e69f2cfa69aa5da9c50b9dfb9149bb9eb5fcee27d60cd542ffd6d795eba931a1aa88d83730bae4f629bb434da21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123404, "uuid": "a7fe9bea-1ed2-410a-9c44-b9f8f065dd98", "value": "T100233BC0A682F9F1EC11457C307BA7725E77F43AA03AEDDBD7D9A423A841602960729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123404, "uuid": "192e5097-7c7c-4eec-b817-c9458fc38d2b", "value": "1536:Ovmt6GStZRjrMcPzOubNarroPGdIYfQ5Igomv4aI:O5GS1HMcPCuhcoPGI7iavjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694123404, "uuid": "c476af37-8319-4e89-bc70-deee65f1e543", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694123404, "uuid": "b485d5d2-ae5a-42af-93ac-3dd92f784b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694123404, "uuid": "26f6861a-3b3b-4bad-b9b0-4489dd7d1493", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844dbcd9-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694103224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103224, "uuid": "df7259cb-b47a-4cfe-8a44-80b9ac26e1b3", "comment": "Malware payload", "value": "81b19a82f241b95060a79fa11f17333d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103224, "uuid": "6c303de2-07d2-489c-accc-043593b3a606", "comment": "Malware payload", "value": "e3224037f5bbbbd7b8e98a2e21707bcbdadbb2d9e2e2709b4c9612d05f50ba55", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103224, "uuid": "3853b968-9c51-4632-a4b7-67b4edc55bdb", "comment": "Malware payload", "value": "47d08180c218d104553a2d72fe644b5116b98e2f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103224, "uuid": "9c4b4991-bc33-4e38-a9d6-0c449434349e", "comment": "Malware payload", "value": "edd674be0699bef8fc22205e8687a40ab7f045119ad392fd2b8c5d33e433066c2edae471b07227dd4b5afc879ce85e5c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103224, "uuid": "3a479736-0380-4f3d-a302-57592cf2ca9b", "value": "T136E43302DF9E4B8CE3DFCAAE33169DC50D71F1644A526E063B9450B89BB356330E9D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103224, "uuid": "736c5eee-ad94-4fdc-9f1a-b29ef3752e16", "value": "12288:D4dwWb9K4ccjdjJCr+T+C0DVpXgHTv+gNuxjgO9Jq:cdwWpKZydjJCr+T+C0DVpUWgsxjgO9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103224, "uuid": "76cb9d72-949b-4553-aa46-b1a358a1e507", "value": 674695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103224, "uuid": "07e77560-7a6e-4273-8b8e-66646710eebc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103224, "uuid": "086c8f57-7f23-48bc-a1c7-a5982524d2a5", "value": "COTIZACION ARTICULOS DE OFICINA PARA PRODUCCION.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce44e22-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694107748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107748, "uuid": "97f71ee8-c733-48db-9601-abba6afc84e8", "comment": "Malware payload (Mirai)", "value": "7cb209cbd44a1406e4e4279572a4dc5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107748, "uuid": "b3ac4b95-1cc1-45f2-8aec-87069ab6c06f", "comment": "Malware payload (Mirai)", "value": "e3c892c78878a091329202c65776d52e8bbffc577ebde647293e344ec01a3403", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107748, "uuid": "7836a40f-361a-4d47-9c75-80cfc3f3ac1c", "comment": "Malware payload (Mirai)", "value": "f3ae8a5686e931ecf6a8c7b711804f7d5fd31bdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694107748, "uuid": "a065bf5d-a74a-4c4c-af35-e3c772b1c36c", "comment": "Malware payload (Mirai)", "value": "a90261fb73d7c12367ea1bf4b70e391c6ce2cac0d8396cbb7b0fe629146cf41e9bd0647a5108459c6d75b1ef1d63acf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107748, "uuid": "202c60f6-b842-4a5c-a653-ddedfd136ab0", "value": "T1B053AE63D4641D90C1584AB0B92C8EB61723F61883533FB6456ACBA9905BFFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107748, "uuid": "d529dc3c-ec8a-403b-b7d8-fa0e3f641a71", "value": "1536:CaV+AvYwcNlQizi2Tgg7yS1KBki2BNApCuX+xr:CRn2ieEcBCvApar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694107748, "uuid": "af289210-502a-41a4-bca6-d16ab847b372", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694107748, "uuid": "f5d0b607-6018-4b15-963f-773d487c7c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694107748, "uuid": "bdbc2a87-fc2d-44c5-974c-b39df5348676", "value": "7cb209cbd44a1406e4e4279572a4dc5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c5d853-4d5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694077300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077300, "uuid": "503e52ce-67ce-4810-932c-8121552d8905", "comment": "Malware payload (Amadey)", "value": "c1f478e4facbb4bdc5dd9ceadcbd7b8b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077300, "uuid": "945e03a0-0ecc-4ee4-bd72-01ad50b704f5", "comment": "Malware payload (Amadey)", "value": "e49d1f46038702a6131fbf13c70daa100e0d8120fa98866d282b286d108aa5b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077300, "uuid": "e9917456-0749-4d3a-bc9f-db93ce86b6df", "comment": "Malware payload (Amadey)", "value": "9f3a65ff1344e5c55f6a3b5f6f8b37efae2667cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694077300, "uuid": "5a6905c8-ebfd-40b0-95d3-b550a3ff5229", "comment": "Malware payload (Amadey)", "value": "6313bdb183b8f534cf66835dd7f76841a63e5d8ab83ac1781c01b387b87a62542cc2d233236f1887c190f94d35b99008", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077300, "uuid": "f83f7f2d-a9a9-4be4-9c9f-7d1ae9a83858", "value": "T1E924F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077300, "uuid": "c5d25132-b0fa-41db-be8e-2a5161d1e8f8", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077300, "uuid": "aada4659-a543-47bd-b23b-6abb06014f81", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694077300, "uuid": "46fd0f10-3986-46ce-a95b-6a7065a7538b", "value": 225956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694077300, "uuid": "053bc5c9-7185-4fbf-ae24-5d015f41ead3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694077300, "uuid": "364fba49-b1bb-41ef-b484-386ed96ff486", "value": "c1f478e4facbb4bdc5dd9ceadcbd7b8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdf2ecd-4dca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694124337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694124337, "uuid": "955bda41-66b4-49ed-be49-5756401d4f5a", "comment": "Malware payload (RedLineStealer)", "value": "af3dfef1fab601fb8d4c235b3b792e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694124337, "uuid": "d9a86eb5-1b67-4db0-9e53-4486a7211573", "comment": "Malware payload (RedLineStealer)", "value": "e4f45c6d4fe93cdf34ccfd2a76334728dd2af53cf1eaf2e8acd32e519d255420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694124337, "uuid": "c944a6eb-f7d1-40b2-a978-1026282a4584", "comment": "Malware payload (RedLineStealer)", "value": "02027793500e9fcec807653a99f208f3f69b947b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694124337, "uuid": "d958bb42-66cb-4332-9232-717f6643547a", "comment": "Malware payload (RedLineStealer)", "value": "c31d70709016cc956659b746957be05b296904131eb38c88b0c7b10f99e28c7ce660b35c5762de3024199f361874fa99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694124337, "uuid": "1f0a2d9a-be22-4413-9ed6-0172ae68c4d6", "value": "T1A0169D1E36608672DE3FFD7B11459E70A1F19E420A7C3BA3D6F666A41C900ACE4A45F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694124337, "uuid": "fe3867c4-1af6-4d67-be8a-e39ce629b191", "value": "431b9eee3827e493b6144e5f38c219a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694124337, "uuid": "dd0e4fe3-7429-48f1-9e5b-1e2245849b2c", "value": "24576:jR9CUaQUIO8uxYCzAnFd0i0sO3f8GwYPtuDMOPz:jR9CUaeCzAnFd0i0sO3f8+iMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694124337, "uuid": "1927eb32-da53-46a7-8566-ff13852e7f96", "value": 4247552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694124337, "uuid": "b6c69aaf-ab64-48c2-bc35-8864915644f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694124337, "uuid": "3ae03873-02ad-40a4-97e0-fbd78b93bae4", "value": "af3dfef1fab601fb8d4c235b3b792e42.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c818ac-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084669, "uuid": "bd9cf87d-18ad-40b9-a2ee-fead56939404", "comment": "Malware payload", "value": "0ef4ad03e5102b1eff0c9d2f66589a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084669, "uuid": "aedc29fc-534b-4aa7-aff1-b14e696b5a64", "comment": "Malware payload", "value": "e5aabc41898f274ceac0ff7c0d0f6442cbd6918b75d504254c4d494276e462dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084669, "uuid": "9e83075d-5026-4258-a9f1-440c35c5f7f4", "comment": "Malware payload", "value": "7a3918b33af41857dc5e5b11f2dcd61586c857e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084669, "uuid": "99fc45c5-4aa9-4e9a-b50f-2bf0207f4b97", "comment": "Malware payload", "value": "d00c7eebd7195b4f50cc459f756dd5fe941fffc479e5ea0da19af7c170cff50133656ad80ef3457e45d1b62ab0c3ebdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084669, "uuid": "4886d621-68cb-421a-a253-c6f060639ec7", "value": "T1F4D38E00B6D18070D0B2423105959B21497DFD716FA59E8FB7D82D9E8AB83C1BA36FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084669, "uuid": "61373710-841e-4e10-9fb3-eb0b65bf6051", "value": "d0a02458b96b0a6cde3068c96d1cdba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084669, "uuid": "bb279c20-fb29-4cf2-acce-798341a98f62", "value": "1536:4Vih9jjOABjWAqUffzNoBcTwE/sNW4Am8NsuPz4cnSXsWjcdy6YhQ45u7hJ+v:4VSRBPCoLY5RIzNdy6Y245GhJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084669, "uuid": "1dd8f379-8eb1-4612-8cb8-4b3df7ad82d5", "value": 133019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084669, "uuid": "77f4d634-d47a-4676-b4d8-a99bcc8ab27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084669, "uuid": "0376da2e-b657-4a3c-8b78-c3113c29b64b", "value": "Trojan.Autorun.ATA_virussign.com_0ef4ad03e5102b1eff0c9d2f66589a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbdf67b-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694069118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069118, "uuid": "81620f86-e9a7-490f-aad2-4a9220ecfc3f", "comment": "Malware payload (Loki)", "value": "2a2886a7c8d27895cc37d6e0364b5be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069118, "uuid": "01a8d1d6-79da-408d-a7bf-cdf7c80114b9", "comment": "Malware payload (Loki)", "value": "e5cad4f3164fb94f713142322a6f3c0fa641a9fbd91b728ed0a60e47d21a7f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069118, "uuid": "06e4bad8-ba93-4d5c-8b99-e19485757a93", "comment": "Malware payload (Loki)", "value": "1ef7ec592990ee52aedd1ad30633f21c34c32781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069118, "uuid": "20054246-7bc5-46d2-8551-7a06fa031ee9", "comment": "Malware payload (Loki)", "value": "62047a7e46168c8a82c521a887afba3d0102c37e0af9652facb9211944350f6fc64a881645d94118cb42170bccbdb1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069118, "uuid": "c7a7dc6e-9c52-4ea7-b44e-aefcd5240b72", "value": "T1A8050202FAD684F2E5721C361935B721A87CBD201E35DB1FB3C8BD2DDA31590A621B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069118, "uuid": "578913d3-862d-407b-9295-e8a6a1e662b9", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069118, "uuid": "1cc8de5a-4673-4eaf-966c-71aa05d5d39f", "value": "24576:wNA3R5drXCDR6lObX0+H9Hj1x8NwPjpqPEO7g+DsP:p5QYgb0+H9z80jpE7gWsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069118, "uuid": "9a4416cd-0649-4be7-9ee3-e99577981671", "value": 857955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069118, "uuid": "a330786e-c858-48bd-bfab-3cd075f3aaf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069118, "uuid": "a129c02e-21fe-44bc-9aa0-f7998db3f92d", "value": "\u00d6demeMakbuzu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9e420e-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071104, "uuid": "4d55d8cd-d25b-40b4-865c-272769e689a6", "comment": "Malware payload (Mirai)", "value": "11d52614b18d9e1010a0be340bab731d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071104, "uuid": "b21f0e64-7884-4ddf-82c0-c655212744c3", "comment": "Malware payload (Mirai)", "value": "e5dc42d21e501a93620e888433631b1d51b1068e1345ec4ef4b9e4462cb968eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071104, "uuid": "b083e505-b5f6-4a65-9a08-a42a9a567592", "comment": "Malware payload (Mirai)", "value": "ae117f4ecbe2fe09e118ba6a458365e7c380baa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071104, "uuid": "36caa90e-5c45-46f7-a84b-02643e198943", "comment": "Malware payload (Mirai)", "value": "411dfe66cd231820a7aca66fcc258d5c7d406a0f3d6878735f6ab9a029ea4cfea366b3912628cca2a784eeb0a54724c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071104, "uuid": "555c6cd7-6545-4aae-8417-7b1c76f0d399", "value": "T13FB2D1E48BE16606C2B0B479E37CCF926A3705E4C6F539232B10927C958249673FD6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071104, "uuid": "b1d2858f-fe79-4435-ae24-b7fea602ee51", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BwavqZOhymdGUop5hu7z:4GaKQFH0rs3zWoDDRsjt7LB9U+Bwas3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071104, "uuid": "c05d25e9-91d1-48ef-b9d9-141a2f1cb310", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071104, "uuid": "7404bdc4-ea18-477d-a599-e04ff48a7cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071104, "uuid": "a2a674cd-56d3-4c4e-97b5-a1a296f0d13b", "value": "11d52614b18d9e1010a0be340bab731d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00767d45-4d44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694066495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066495, "uuid": "dc4970f4-2d51-483b-bb0a-b21067d16c7d", "comment": "Malware payload (Amadey)", "value": "03f76237d46e7fb6701a7f60365af7ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066495, "uuid": "5d41d962-6605-4e7e-b11c-bf1dda594e39", "comment": "Malware payload (Amadey)", "value": "e6c197fa18cc830ae53dfa62de5a0ff340e4d4c1ddb59a009d14f14b79c6b007", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066495, "uuid": "a8471246-88af-466a-bf74-4cf2ef7ec52f", "comment": "Malware payload (Amadey)", "value": "2046015d189d6c3bbb5dc2d64716131177669dbc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694066495, "uuid": "854fb149-f0a6-4aa7-8b8e-17f221786c3f", "comment": "Malware payload (Amadey)", "value": "e5462ebd9699eaa0bd36172a2b97c731896576300a32581387507f80cc04b6cde6aba1fb2ff3bd6e72f3399a6ce4a494", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066495, "uuid": "b9da5c3a-a4ae-4b7d-9128-bb609e3a0e86", "value": "T1B924F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066495, "uuid": "e7c271f4-443a-4898-92cd-118895b396f3", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066495, "uuid": "e9babe18-14bd-45c7-90b7-088eeae6d3fa", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694066495, "uuid": "e99c5bb7-5021-42a0-9270-d987e94a9088", "value": 225818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694066495, "uuid": "0346ed57-d542-40b1-9095-c215df33a4b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694066495, "uuid": "6de0ee18-b0f8-4163-870d-7acf00356144", "value": "03f76237d46e7fb6701a7f60365af7ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e48b86a-4d6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694085175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085175, "uuid": "e5a828dc-dee9-4225-8c16-e613590ae591", "comment": "Malware payload", "value": "6902b4158d8148c200ce8b7882bdb37a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085175, "uuid": "6f63053f-c872-4ac6-9a85-c3e26d8c8934", "comment": "Malware payload", "value": "e6e9e7f04e5834c13899e35b6f5e35adce5a8b6005f24a02a9e4156b903d5c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085175, "uuid": "84fff411-6469-48f7-89bb-40e494e782b4", "comment": "Malware payload", "value": "dd4fffb6aea6bfb50191776eaa2792f8305b7e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694085175, "uuid": "14f4df83-10ad-4bbb-b432-a56506833828", "comment": "Malware payload", "value": "412a48a6b55a69a695a797cdf1fcde17f04b2d5286ec733174c913ef85b3dc83a42be2d3a3fdf9f89e4663b18fcacc68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085175, "uuid": "8d5b00af-1df2-4d04-aec5-e168087a8d76", "value": "T17FE4D512221B8858F390D27791618AE6ED605FC62CE2C502FABE7F197F20F534EBD525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085175, "uuid": "28e5897c-a2ad-40e0-85ad-9c449e56ce84", "value": "d3cbd6e8f81da85f6bf0529e69de9251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085175, "uuid": "4a4ace93-5bdb-479b-b261-6689a6d6e06f", "value": "6144:/qDAwl0xPTMiR9JSSxPUKYGdodH/baqE7Al8jk2jcbaqE7Al8C:/+67XR9JSSxvYGdodH/1CVc1CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694085175, "uuid": "410bd7a3-16c8-45cf-ab7a-3d20280f0996", "value": 718158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694085175, "uuid": "bebaf7d6-b19a-40d0-811f-664843aa6f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694085175, "uuid": "90a372e1-0c88-4070-b07d-f09728b2f4a4", "value": "Trojan.Autorun.ATA_virussign.com_6902b4158d8148c200ce8b7882bdb37a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af523172-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071083, "uuid": "a4def6f2-2113-4507-8ce8-eab12de9be18", "comment": "Malware payload (Mirai)", "value": "4f5d10c8d520a61a61598ad23faa5639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071083, "uuid": "6895a769-ab8c-45ac-b0d2-b6fac51869ea", "comment": "Malware payload (Mirai)", "value": "e6f2160423759d018cd7dd0003d1490a3d0772330e3c6f2adaf472ffeae47c5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071083, "uuid": "766471b7-7637-421c-aaa7-360f0d910b87", "comment": "Malware payload (Mirai)", "value": "57987a1ebbb40bdb9b6d1428bf6d166048e44cc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071083, "uuid": "21283919-6132-4ac0-be1b-eac4c430a801", "comment": "Malware payload (Mirai)", "value": "8669a2ba61d8c8eb668f1f3a81f72bbe5f3c84be69c148becd9f9847cc04a6f25adf192d196aa320072cc5e91bbbe77e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071083, "uuid": "6211d7e9-5e8a-434f-95e4-31101103c29d", "value": "T19F536DCAB8119E7DF5CBE77E84220D0EB821726150931B27BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071083, "uuid": "8181402a-a357-4701-a393-860e17707817", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8e:N1TjJ8EVGO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071083, "uuid": "89e88563-fd71-47ea-9286-7b4648c468d3", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071083, "uuid": "8048f85a-03a3-4374-86c1-ed6a4b9d9ab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071083, "uuid": "8ac033bf-a54a-4576-9318-6e7884e519c0", "value": "4f5d10c8d520a61a61598ad23faa5639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ba9057-4d4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694071099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071099, "uuid": "7b2ddbac-e5f1-4175-adc9-a8a78c959acb", "comment": "Malware payload (Mirai)", "value": "c36c01e751bee1d6ef15d989c7a1206c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071099, "uuid": "d2afc955-a842-4dbb-a74d-48538635f83a", "comment": "Malware payload (Mirai)", "value": "e78ed0321e25bbb7ac1aacf1c7a93aa7c7470e549d48e4a333f60793ae2ad6fd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071099, "uuid": "cf6068cf-d1fb-4330-8ffd-b4a52ec73b1f", "comment": "Malware payload (Mirai)", "value": "19fda24f9e4b0ef50b614796058196261bfe1cd1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694071099, "uuid": "097277d9-e493-4326-b284-3595e853a0e7", "comment": "Malware payload (Mirai)", "value": "cc20f6474dc673e902f7aa7fd42dea981ee78d8361e0cad1a6ba9371087f83a1fbb5b28bf13d63fb564e3d9681202a4a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071099, "uuid": "0f48a3d4-94d8-4e58-82ec-202ebb473023", "value": "T116D2D0FB557FF177C072B878306015C8FB383512E22E5B2F0CE6BDA865B66812750A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071099, "uuid": "7cfa2eae-d062-482e-8219-c08d4ba149dc", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPIE8Sx0sB:UYJdJZ5UQVH/+KPtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694071099, "uuid": "dc131cfb-6ee2-45f9-b587-d6c5138b68a0", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694071099, "uuid": "fd18ec30-23ab-4d2f-86ae-a7658831875b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694071099, "uuid": "a2209bcb-2298-4a1b-9f30-ec37a7672f21", "value": "c36c01e751bee1d6ef15d989c7a1206c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fcd637-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694095740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095740, "uuid": "a04d20f4-63f4-49bb-9d86-671a97e27680", "comment": "Malware payload", "value": "9d331ee86e78c11268ddcea7941bd599", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095740, "uuid": "708058b2-e1b7-467e-ae1f-6494d992a700", "comment": "Malware payload", "value": "e834b9a99122a2c29558ececa67e7f49b26eab1d579a5de76f016323c421a624", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095740, "uuid": "27f90438-45a4-4295-a9be-e438a869102b", "comment": "Malware payload", "value": "803c9cc2ec7645e32b3948ac3746b44aa0f57b9e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694095740, "uuid": "9d3c7ef5-d47f-44fd-b3eb-ffa1b8025bf6", "comment": "Malware payload", "value": "15d3b0cfc3a0f0c1567cc79279ef75106e495d22e2c921db00397eccc59968df01fc9ace56f1775d50968ad5ca1489db", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095740, "uuid": "a11d6459-d73b-4774-9735-0a1a3456dd40", "value": "T1A431E0F627195421D4F2CB516D17B05ECF108077A8455D04F8ED4A65EF72122936DFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095740, "uuid": "0d6b486a-1d65-44e8-9435-2251301a6168", "value": "24:OO8upjhAd68Sa3jrCg9SEdjvpd6TT71qEAu/c/oOsv4Pj0J:OO8uPAia3HCgrX+qEAg8j0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694095740, "uuid": "13b0edea-8cbd-4d70-9ded-85f10f6ed46f", "value": 1447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694095740, "uuid": "05029181-e30c-4197-aabc-b500df9c8f6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694095740, "uuid": "18686c27-0017-4bd9-b119-9a82f8b6cb67", "value": "q0qePUZ2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8be349-4d86-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694094916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094916, "uuid": "6e8037d0-b3bd-4b89-bb09-ed9751069e3f", "comment": "Malware payload", "value": "41d23655b2ba1245d2b7ef7393b414b8", "object_relation": "md5", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094916, "uuid": "0439948d-8ab3-442f-94c3-a24fcb8565d8", "comment": "Malware payload", "value": "e844e8ec9f5dcacd8f184e5b0fcd4a9a0f02246023cdba84275053579001ba1a", "object_relation": "sha256", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094916, "uuid": "6e5afd5f-f82a-4d6f-a677-45642223b697", "comment": "Malware payload", "value": "e53646f2c7ec4f7f89afd090498ccc1e7f5809f7", "object_relation": "sha1", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094916, "uuid": "6040f750-f4ad-486e-9f2d-64020a834507", "comment": "Malware payload", "value": "796b8ae43f3336dc99209c25685415c63e71b9907155199f45e6116152d3103d701a7200fe432f672a43ff043a2eb287", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094916, "uuid": "e54f0a3f-ff60-4673-8b5e-bcfdf6c35fbf", "value": "T16B01CB0A090FFDBE1887F3C6B67806902FD39040E5483A316B454C1F9E72C2994DE888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094916, "uuid": "eb0405b6-7e97-4879-865f-8c1b40451194", "value": "12:kxS2hz7YU+Sj8zljGSGpbjsz3lnxOZ7+DP981E7GXoKIDWss1CYuJSuhrHwm:kI2hzEPI8zljapUz3lnxOoG1fXtIDvsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094916, "uuid": "7d95b0ba-a64f-4e9a-ab33-665b875afd43", "value": 711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094916, "uuid": "46eb1ebb-3666-4d6a-8574-90fa50bcdf8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094916, "uuid": "f27191bc-aaa5-4523-987c-4460bbc0d72b", "value": "Client32_1.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe991e5-4d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694050576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050576, "uuid": "4b6704e2-f42b-49c9-b5af-e7671185e6b0", "comment": "Malware payload (RedLineStealer)", "value": "be3b1b53baab0b6a50ddca5c78094166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050576, "uuid": "341a1205-81b1-46d5-90a6-58c9acbc849a", "comment": "Malware payload (RedLineStealer)", "value": "e9195a829976701a667698a160c783350cd268bf303ef1fa36f1d7c66aa473bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050576, "uuid": "31008695-111c-4c45-baa8-d50118272991", "comment": "Malware payload (RedLineStealer)", "value": "05ea39b530cb30ccff80ae3488d239cd408c081e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050576, "uuid": "4aa2f1f8-5979-4257-9d43-39561cc2f687", "comment": "Malware payload (RedLineStealer)", "value": "f0ae7c6f5f8ce4018417b76a458996b7b95f7a335ced4258a73916da59ea7c2076f8458766bddcc7ddbd29eb45e379fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050576, "uuid": "f5be1697-579f-43ed-80ba-d999438f75c8", "value": "T1D1E41246A7E48033DCF11BB059F717E72A397CA28938C7AA2345991E0D73A80B53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050576, "uuid": "bf8d0372-1a00-49bb-807a-64ce6147e2ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050576, "uuid": "610ddff0-cf8c-453f-a0bb-4c2e6bb20761", "value": "12288:xMrry903fCbEHAUi67N57h1hOBftafgf3dQSHIKYiLrSyOvdTh:qyA6AgUiE7hC5Bd/HIzcmhvdTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694050576, "uuid": "54998710-bafe-4c3b-ba34-15b3104185a4", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694050576, "uuid": "f7317fde-9b05-4201-975a-e0b729b2fa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050576, "uuid": "86dff5f7-002a-4fda-986c-f6021ef31a82", "value": "be3b1b53baab0b6a50ddca5c78094166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73a4801-4d65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694080948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080948, "uuid": "9d3cf752-b490-46ee-bc2c-39fe01764498", "comment": "Malware payload (Stealc)", "value": "076c09450432c7d4fd86e6fe477ad5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080948, "uuid": "d372b365-257c-4c0e-9a3c-d7a6b9f605a7", "comment": "Malware payload (Stealc)", "value": "e998bbead443cf538740faaf375c3ee98abb7f2d3c313e9af96b650e23f92ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080948, "uuid": "23b41b92-1903-46ca-8a83-eee44c084964", "comment": "Malware payload (Stealc)", "value": "b3871352db1ca51ddb33703cec07b0abe7d903d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080948, "uuid": "c1b4c7ad-9a2f-451b-9524-0514a7fabc4c", "comment": "Malware payload (Stealc)", "value": "18f4103f56180428c901d01f9ba200976df142cad1c7de94a306a177f1e20bd45c2aa753325d6505bcfb2b328f791581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080948, "uuid": "15d6e3c6-ac02-41d9-8423-20da5e42bd4e", "value": "T10B646C1392A1AC71E66746318E2BC2E8261EF8E14F5E76EB23589BEF1C701F1C572711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080948, "uuid": "b8288f3e-6f7a-45cf-8d8a-8d1927669238", "value": "b890c40ce8bcf6bf76e64f737678ffbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080948, "uuid": "5c2e7896-dc15-4124-b81a-c8389df5729f", "value": "3072:vXip9qLtrf3wEHZE4BXiZEb/VVB2VJ5hxl2OwjD39bF96CdUh3aRwVkgQP/3mU5:vipOb3VayXiZEfB27fWOOBFs8UM+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080948, "uuid": "1761e2cd-c570-48c4-84ac-9fa68745df6e", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080948, "uuid": "eb3f84bf-227b-4908-99fa-a1dca10ce37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080948, "uuid": "0068d972-fd0d-4005-8b97-e4b5e5537488", "value": "076c09450432c7d4fd86e6fe477ad5b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bf3af4-4dc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122129, "uuid": "593f50d0-bcbb-4986-a50c-84ca0be8f4b3", "comment": "Malware payload (Mirai)", "value": "df4d48462ab66330c2193914868d0285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122129, "uuid": "268cc58c-40aa-4ed3-a1de-f688f5739eac", "comment": "Malware payload (Mirai)", "value": "e9d31148e34810b58d184dee074a0b48c2e4bf508e07d5e78b801a49980efb73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122129, "uuid": "a938087e-d3ca-4418-bd5d-00b979a6ffd0", "comment": "Malware payload (Mirai)", "value": "32fdc886b3ca3e2bfd76d65511e251027edf3cd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122129, "uuid": "597c445f-ae9d-4a9f-ae1f-48f5863e5fec", "comment": "Malware payload (Mirai)", "value": "927f6a89ecd1903a8ebca858dea6873c5ba63d3cecdcc4426c0b65f535aecdc7851b9ea2ac9b022f4d1ae9d61114974f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122129, "uuid": "cb9bf5f7-2df7-422c-9024-d89430b5ac1c", "value": "T12DD2E09876D753FA8C8DC9BE720F402A349A74E9B7B29363B301D5430B36180E652E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122129, "uuid": "412c30ee-baaf-46ea-9265-8da5a384c6fb", "value": "384:MPd/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BKU1GbsNyq:0lxKd21RhxEnsD16IHE4RlY99031G1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122129, "uuid": "b34f61b3-aab3-48bb-91da-17e88c7d1573", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122129, "uuid": "5324a523-aceb-48eb-8079-3d7e294af52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122129, "uuid": "6fab039a-dbdb-4e67-8c2a-772aad273bba", "value": "df4d48462ab66330c2193914868d0285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb22aae-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103055, "uuid": "37c62360-dd1b-40b0-a311-b5002cb85f86", "comment": "Malware payload (Mirai)", "value": "fce334afc6b6fdb463cae627f82d78b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103055, "uuid": "1e38a93d-26f5-46cf-b248-8e6f9cbe042c", "comment": "Malware payload (Mirai)", "value": "e9fa1358455a4d4ccaa177d55f715137610653bedb03e00a08fd5d59cf310553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103055, "uuid": "82bf6b52-234f-4487-a733-78846fbeff44", "comment": "Malware payload (Mirai)", "value": "0188633b4dfe99a7305666659de8a6ce323bbe20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103055, "uuid": "f879f69b-5203-4b50-ac2b-dda643339953", "comment": "Malware payload (Mirai)", "value": "69ce672cea50a3adeeb2ae5e8b05aa40d2184bf5fedf80994f8bb423b1f48191efee403014667ce1c6ff38875514d316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103055, "uuid": "b7546a91-5a25-4474-8de5-87d3bdf40b1d", "value": "T166C2D044F145DE05DFEB29F13D50CADBBBD42F1EAA668E8032A452D25B6D2B34306DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103055, "uuid": "e8de01ae-73e9-4c2f-ba81-d35351c1ec32", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7Pg184uVcqgw09A:tam+AnKehPRa9aV4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103055, "uuid": "a02494c3-d901-44e2-9c1e-b941feb3be26", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103055, "uuid": "1904702f-ce97-470d-b508-b406c1de6fd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103055, "uuid": "00445037-a683-448c-a84d-85f71b26e337", "value": "fce334afc6b6fdb463cae627f82d78b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01aa56d8-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075517, "uuid": "c2b89d60-c2a9-40b2-b2d6-6bd3658b8fe8", "comment": "Malware payload (ConnectWise)", "value": "5f7157fdd450ad67a07aa201e2aa22c2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075517, "uuid": "3842e842-0bee-4afb-98e0-64d525070184", "comment": "Malware payload (ConnectWise)", "value": "ea06ba731ee71f76610c3d134a405defce07c6351cdb7d0d69e00fa901d9c70b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075517, "uuid": "9f762ce1-a807-4615-a286-414a29fd4d03", "comment": "Malware payload (ConnectWise)", "value": "fc91324a21f5cf40af8b6efe86e16026349d2b0a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075517, "uuid": "6e1f6a59-8bdb-4208-8de6-46d54500e7c3", "comment": "Malware payload (ConnectWise)", "value": "e3e567241043bdc874b7147624d23dca96394ba7bfe08d83b2dbffa79720fff218af66948c75f7befd174b08c686d9a8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075517, "uuid": "f703cc82-4c06-411b-ab09-54a3f2879829", "value": "T1FD835B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075517, "uuid": "3763dbc8-d574-454f-be64-55aa53dec4aa", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075517, "uuid": "39f26505-d594-4ee2-a5cd-400066540be3", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Lk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075517, "uuid": "3b2c613a-a5ce-4b83-8689-77bb43801a5c", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075517, "uuid": "b66943fa-8123-4ced-aac3-65a550e1f96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075517, "uuid": "983228e6-2946-490c-b440-d914940233af", "value": "5f7157fdd450ad67a07aa201e2aa22c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dce294-4d47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694067903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067903, "uuid": "69a85b7c-b115-40e5-b815-acd69c18605e", "comment": "Malware payload (SnakeKeylogger)", "value": "6d9407313653c510e3dbef2832ea9398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067903, "uuid": "575f4ae9-9d64-4049-b8b1-4fda317851b0", "comment": "Malware payload (SnakeKeylogger)", "value": "ea4c93c7108d234fa463739575ee27035d327f026c813b39ba2b93a634cdc7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067903, "uuid": "3f0ed493-2f5c-418e-84c9-0e267c8c604a", "comment": "Malware payload (SnakeKeylogger)", "value": "f506be154b4a98373a4b76c7957a4e544413cbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694067903, "uuid": "59e59b56-0fe1-4e4c-9a37-3885117be800", "comment": "Malware payload (SnakeKeylogger)", "value": "14ad83a39a19f060fcd5cfb21dd5172e545f052395a861072286d0fb6312ac328d53e358e38705ef2ce6928cc55ddb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067903, "uuid": "1dfd17dc-5a9d-49d6-856a-2c918cd1feb6", "value": "T1B0C4125AB3FC4B16D23B6BF12451118003767926A4B2E7491DC320EF29F1BB20A43F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067903, "uuid": "69e6a978-af4a-4192-bf6d-26de0c07f598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067903, "uuid": "c4fa7fb4-334d-4c8b-a0e1-e2b3495c376a", "value": "12288:r3NE2iNHkDwMD8saWgeHsGuS6kbAVuHS9qzZkivXPAirT45QxzEz6oiiRZ:r3NE1RkDV8saWgeMGuS6kGuyetHJrT1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694067903, "uuid": "9a15e556-7e40-464e-a7b9-d27c7462685d", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694067903, "uuid": "f8ccd870-c3f0-4857-a8f4-05e8ff4a391c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694067903, "uuid": "20e5ce68-3a9a-4b82-911d-52357d95f926", "value": "Haikbank_Ekstre_20230906_081940_689633.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a5dc3e-4d9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694104595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104595, "uuid": "3f061cdd-0d66-4bfc-8bc2-46e5a7374777", "comment": "Malware payload (Amadey)", "value": "f01ed07184ee3aa34898d3ceefc5c8d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104595, "uuid": "66305df2-89e7-48b1-803e-e7ee1631a464", "comment": "Malware payload (Amadey)", "value": "ea4d50c2d07be724dd8bf8f3df32a54e3a54097978bd484a1bda54a29ab1e6a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104595, "uuid": "9a25653f-b10c-4014-b2f2-540ccb444a81", "comment": "Malware payload (Amadey)", "value": "606f6504536830dc15175f6391d80c7ac7ef89bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694104595, "uuid": "5f16057e-3f3a-4069-95a8-e5d2ab1e4509", "comment": "Malware payload (Amadey)", "value": "e60ab074620fd23aa41134f0feaa4f7712e7ba553a63cd482a5601507eaad598c335833afdcfeb5963d2cf4938b4a179", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104595, "uuid": "99a6ce82-f971-4bc1-b82e-94e576586a83", "value": "T1F2645C13A2A0A961D62706314E2ACEE86A1EF8E04F5536FB13549ABF0D717F1C57231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104595, "uuid": "5c6d73dd-9223-4759-80ab-e1d00ed6a4e0", "value": "e77054925f91bbb709fc17135ae0c093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104595, "uuid": "199cfdca-a097-4e03-9f7f-761e46891650", "value": "3072:8MoO7WsdNnduzeUcXWR+ZYwQoq6M4fNWxNvBjTG2/qY+ADoQwRQaxrJ9xGNm+s:t2ANBUcXWzw1qMgNBP/bWRXX9ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694104595, "uuid": "ba4b8f00-6de8-482e-89fb-0ece5fc58a2b", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694104595, "uuid": "03a2b3b1-44a7-4521-a5d1-8f2da0269bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694104595, "uuid": "c8fa5a23-0d2d-441e-9bac-a15250517746", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383da3c9-4d8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694096653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096653, "uuid": "9c2b5dab-c65f-4ee4-ae63-f3fd73e00b9d", "comment": "Malware payload (RemcosRAT)", "value": "83f5956302707de53c3d6634e24f0389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096653, "uuid": "8feac255-9fba-4630-aacc-24b8c67fdcd7", "comment": "Malware payload (RemcosRAT)", "value": "ea9723cd4dfeb319cedc75c0dd4cb5fa326b995580aee939085780092aafcda9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096653, "uuid": "17e36ea7-3271-4c00-8495-402459cc28b7", "comment": "Malware payload (RemcosRAT)", "value": "d08e6acd8dad5fa97199453de08dbaa9f8b8a362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096653, "uuid": "38c2e151-90cd-451a-8800-d88a5805d6b5", "comment": "Malware payload (RemcosRAT)", "value": "fa476018062187ec250b3dae30a8f291e3c92a0b18c9577cf14f067d1a8449061159232f620ad7347d5d203cab062db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096653, "uuid": "5647d9ba-12ec-4bbf-8839-9bc28764de53", "value": "T13FB49E01BAD2C072D97514300D36F776EABCBD202825497BB3D61D9BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096653, "uuid": "714fe71a-1b87-4df7-a337-da538cabe725", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096653, "uuid": "19d85aec-bf5b-4890-9fda-14f687e19ab5", "value": "6144:wu/TwNrjB5ikgxx+bdPoWYnRmCgEVAWK9goN1dFv/xpM9rsAOZZpAXNc7Ibv:wu7wNB5iedQ1RmPEVAWONjpcs/Zp0bv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096653, "uuid": "9188a664-c75a-4701-989d-d4a6ad923cd0", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096653, "uuid": "74611ee9-0d8c-4580-9ee1-3d7505b4fe3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096653, "uuid": "311c24de-7acb-4a06-92dc-ed8678219798", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9da343a-4dd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694127848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127848, "uuid": "957a6e04-4489-4ff7-b4dc-bcf6dc885954", "comment": "Malware payload", "value": "89074bd6aa5cf217fcbdf126809623e1", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127848, "uuid": "e2fa99f5-5318-4ae5-b9fa-832899619ec7", "comment": "Malware payload", "value": "eabf3c17a2d8ab9e8ea6a1c2810fa8bc0b3d1f922030df00b0e127038283873d", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127848, "uuid": "c2f5c35c-aa54-4085-9971-dd8d5d99f48b", "comment": "Malware payload", "value": "43a3adaf4fade46c11397606d4c4668e2a173878", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694127848, "uuid": "d6e77a9b-1257-492b-9429-33cc92ab0301", "comment": "Malware payload", "value": "7ebfd58d7747c92569f4163cf28d2b4c650f8407f9327be0b902d4871f7bca44303a051614d4bfde58e4875aacfc33fb", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127848, "uuid": "01d577c0-f649-4810-b1eb-64f7144fa1f0", "value": "T144C08C20461AC12680AF44088C088DADA82A9040226FE83002E15A8CF9530698F8D488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127848, "uuid": "80a67e31-9517-4df2-a75f-d772c6a00b4d", "value": "3:HRAbABGQYmjVLOBLXAdVCEKEg6LD0o1YSo/QJ5z/QvyYesbBSn:HRYFVmpgAd4EfHkSoIJ58vyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694127848, "uuid": "3b504a9d-6098-4b58-b754-073e95dbfd34", "value": 145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694127848, "uuid": "b811cfce-975f-4d1e-9554-d07a8853d467", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694127848, "uuid": "1cd5ef8b-26a0-46d9-9db4-67e307b28998", "value": "client(V106.215.441-upd).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cdad6a-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052389, "uuid": "69f66712-c535-4e5d-ab05-dd9f96f8c0b8", "comment": "Malware payload (Amadey)", "value": "e25bc3e8820742cb7737255933aeab46", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052389, "uuid": "c2c3488a-7a0d-4527-b98d-c41ae65bd46c", "comment": "Malware payload (Amadey)", "value": "eb45cbeb12ffb3b571c6873da56ab454ee3a03c870c929078c40a91db58d8554", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052389, "uuid": "f7e35fd1-e94b-41a6-bae2-c20e92948576", "comment": "Malware payload (Amadey)", "value": "608f761820bc2d4079acab13a7836df6f4ea50a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052389, "uuid": "8a77fc61-d80c-4022-9620-260ed30ae5fa", "comment": "Malware payload (Amadey)", "value": "eae6bcada293507b939f79f00b9093f936aa0fd43d40df27cc5805db8face213b4c12d64f03746bf6e6c0fb2607b3164", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052389, "uuid": "ff15ce6d-ce98-47e9-892b-ae54d3412cb9", "value": "T1EA24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052389, "uuid": "654edd93-ac6f-4bde-9dea-73f9a2ddf01b", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052389, "uuid": "14543679-4017-467e-a066-c867877ccd09", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052389, "uuid": "70c295f5-7b59-48ca-8183-9c26462ab941", "value": 225479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052389, "uuid": "42e3ee11-633a-438e-aafb-04563a531cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052389, "uuid": "ba2cab6f-2a35-462f-8fc1-ad07bb3adfa8", "value": "e25bc3e8820742cb7737255933aeab46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa2f798-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694103073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103073, "uuid": "0cbf1b49-bb5c-4728-8c89-b28cfe82f7ed", "comment": "Malware payload (Mirai)", "value": "ca4600126b11376d1f6a7dfd66188351", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103073, "uuid": "b4d723b7-1319-4b6a-9ab4-9c8e589abcff", "comment": "Malware payload (Mirai)", "value": "eb571b02e8fbf579827169c309b3dfcb90f71705bf9d6d521198b80d26362241", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103073, "uuid": "f9609f42-568c-4fbd-a94d-68204d61235c", "comment": "Malware payload (Mirai)", "value": "e0ebec6d4b333a6af986e5a304a2ebfe83986b6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103073, "uuid": "d250bc01-cee2-4452-825f-2e1cbea25c02", "comment": "Malware payload (Mirai)", "value": "d1861f0ffba525ad001d8d6ee36e2bab23331486d7ed947d88387e9826184b415644aff5faf51832649b3a806ca633cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103073, "uuid": "9ca7dacf-289d-4cf3-9e6f-7621fcad9884", "value": "T15E735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103073, "uuid": "904a5847-f158-47b1-9bab-067239eb43a8", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws84:YwfdNu4cmZvFqI3w74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103073, "uuid": "1d8b8488-784a-4806-ba81-51ed514ab97c", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103073, "uuid": "23f0eb69-e41c-40d8-b5e0-5a9db66cea74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103073, "uuid": "56e53cfc-0f42-4f50-8eb3-8a83266d217a", "value": "ca4600126b11376d1f6a7dfd66188351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db37669e-4d78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694089196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089196, "uuid": "ba3d292b-e47a-4e82-837d-be5eba892fdb", "comment": "Malware payload", "value": "0490c640b978081fb346cb1a42b3a436", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089196, "uuid": "89df4151-b938-44f2-885a-0a5528557a40", "comment": "Malware payload", "value": "ebc0ba1a6364c88183dda1fd74100489bca46c050bab4df26502a0722d582699", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089196, "uuid": "20fe9e43-924f-401c-9488-47e01035fc9d", "comment": "Malware payload", "value": "d9224485d8ee6465115586a1dbfd4ebe7256b3de", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089196, "uuid": "9452f085-a8fb-42e9-a5e3-27b596fcfff2", "comment": "Malware payload", "value": "f321652042e72cf02e4aa85cee3fc7e9a908c757e2f5bde78c0478b538e2f86412de13a1694f5b0ebdb0dab9a6f3ba23", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089196, "uuid": "ffad3359-b26d-4db7-9928-71ade8bc2907", "value": "T122C2AF7947B49A8C091122B5265981FB089456FEF0E09F9736B444FEA3C847718ACBFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089196, "uuid": "199a9b77-e675-4aa8-8fc5-f0e59aa9f2ba", "value": "768:OrZ2+FPfcv9JFFDE3nnmI8sNv9zc7r4xUOBlUPkm6D:OFFZfc5FDEXnmtK9zc7r0XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089196, "uuid": "74e812cf-395a-4bf3-8d70-8dde8bbeff9a", "value": 28039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089196, "uuid": "524ee8d3-5852-4fb6-a82f-a6a26b0e363f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089196, "uuid": "3f224b8d-d795-44a8-8420-825750d929f1", "value": "W5HRMhVi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d1ed54-4d99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694103251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103251, "uuid": "387c2702-c0fa-4456-beed-24ecc42f306d", "comment": "Malware payload (AgentTesla)", "value": "2db3e62d2633e9c258688775ba64617d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103251, "uuid": "f0d55a33-4dab-4dc2-9a38-feb0a6ca4a9e", "comment": "Malware payload (AgentTesla)", "value": "ed3982e7290f9d8480fdc01e4828f4fe317c9a875180fe72903aa28906479e4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103251, "uuid": "a32f7795-067a-439a-a035-788eae30654b", "comment": "Malware payload (AgentTesla)", "value": "edae29c54865823fee69c2b58b5277bee6daf7b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103251, "uuid": "f11f2dde-35f5-4966-9b88-e898cd8763d0", "comment": "Malware payload (AgentTesla)", "value": "1785ce98a0deee99fa2fe0ca992cd18ccd33f0fd6b13b8ae46f1e87009832257b225826a4d56479678065aa6c50e387d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103251, "uuid": "54dc47a9-a93e-4ec9-a2e0-dec2faf72b1b", "value": "T135E4F0F86066C7E2D3B487FF605794B09E27BD01647496DD3B7C36880EA9ADB0921C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103251, "uuid": "ceae7fef-d931-4090-b87f-3263d2876781", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103251, "uuid": "dde6839a-9d1f-4d5c-a6e8-a668f17c4f56", "value": "12288:L5fVsbR2PDpufCe9Z8zgW0dh65hEfrNyGbYqRPbxfo+T75K1pz63dC9F1oSQl/eZ:LtO2rpNChKmEGsqRFfo+E1lKda1IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103251, "uuid": "0ea203a9-eca9-493b-bfdf-b9aab80ffc15", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103251, "uuid": "9c9a7f31-4d67-4795-8f33-cfcc8b80e178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103251, "uuid": "a180f365-538a-4b01-9b5b-4ca6ad00466f", "value": "Dekont_26378846374,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5da7148-4d6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694084865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084865, "uuid": "4fb336f2-a44e-4b4a-80aa-7c94ce2cadb9", "comment": "Malware payload (NetSupport)", "value": "9c9a7a6c0d1b78b50ddf76ea1827c18d", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084865, "uuid": "41638319-247d-4bd6-aeeb-3c880d2d5526", "comment": "Malware payload (NetSupport)", "value": "edc03e10fa67bd6757013a753ab5bb01c4faa6e53b0d2f9a273a3cccb67abbeb", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084865, "uuid": "4e67725c-b49f-442d-9020-0970e560975a", "comment": "Malware payload (NetSupport)", "value": "32c53bb4adffb7fbdd18178de7f6f5decb1dfc0a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084865, "uuid": "1832f633-b9b2-4ef3-a73a-79f83c255959", "comment": "Malware payload (NetSupport)", "value": "fde7a1054c6e93971f295044627b14415535d6d2b9cb19674b88c1decac7cb22cae394cb8ed07ae104bbef56b352b1e9", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084865, "uuid": "6941c0b5-a1c8-4f45-aa68-48440a43dcb0", "value": "T130263339750A6159C3DB90B85D8B18C3BA87EDB652430DE7CCC1394588CBBDCF8676A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084865, "uuid": "fa4d810d-c80d-46fa-bed6-348732d2cddb", "value": "98304:NqQuy6+1VvvqYt+AkMS36mTfxmCgNsxOGvWUuUy0FFDH79NkcT5EFwH:Nqq6KVtADPSGvz5yyb9e45d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084865, "uuid": "574fc506-eab3-442a-83b6-8aeaaa0c638e", "value": 4836488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084865, "uuid": "c90350b2-c3ed-45a1-bf1a-f47216d273a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084865, "uuid": "dd796630-c143-49ec-84d4-4b9af5caa957", "value": "local-en(brwrs-update(stable)).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b47a6c-4d9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1694103954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103954, "uuid": "b3619413-ee84-4f32-8a1b-831e29947ccc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "53069976a3e9a327de6dfb869fd98a6c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103954, "uuid": "02aeb71c-297a-477d-ad9f-8f07489ca054", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ee5ce35a68761315dc14c27af6cb25128952bbde67a699b5c69cb21081a3bd75", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103954, "uuid": "2d1cbe67-9930-4451-aca2-77d8203ce77f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2c8ffbe9eb465a0c392f1e6579300981896dc239", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694103954, "uuid": "c151f084-8358-4c11-a775-5ccb1dca65cd", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4b1a087b0870816ca41138439244b0a5ef8d79cd06446329c422f0d0f4f509e1be0ea7d4d177a9e8805fbd27a5b73a44", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103954, "uuid": "ffa3c59e-f267-4e90-bc6c-1aff54d19db3", "value": "T184553342F902597FE015A3F58E69829B173ABC1B28308C5C66DD8DDA0F7F217C14A76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103954, "uuid": "31d151ec-bb82-463c-a732-d90eb5d8540e", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103954, "uuid": "d0709392-0c8f-41d5-b16a-10e4a01914e2", "value": "24576:aI39dmMZiTzSW2we9VWrqet+q5roNcrvZdvNC1OhgebVKoyInpD:a6dma6zSPHLeNroafvNosVbvfnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694103954, "uuid": "b3597b11-c53a-4c33-bfff-604e9619d2ae", "value": 1292785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694103954, "uuid": "9ec53330-d4f9-492c-805e-f0449f297631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694103954, "uuid": "d8503195-0e0d-45a5-a1af-6ace977f7edb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba77c8d-4d66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694081251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081251, "uuid": "e8a12b7d-4756-4d3f-9c5d-ec7600b8a8ea", "comment": "Malware payload", "value": "8523f7d16552e1775c6fae5ef3f018af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081251, "uuid": "d11e3d50-8323-49f8-80c6-ca8c2adf3ed6", "comment": "Malware payload", "value": "ee6eb44ef159328f2802d2f54dae785f2512c421f808cdfd8eca1376134b8f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081251, "uuid": "eb74466d-29d2-4aea-9138-c21c2935764f", "comment": "Malware payload", "value": "d4dad2164b01a95068816e638fb92ed0550ac0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694081251, "uuid": "cefa0da2-d9c1-46ca-98e9-8d0951cffa99", "comment": "Malware payload", "value": "4c50b1b9d63cd0d35629b0a3cfe4c5e011747aace256291fe1e3db57ff80c93b3359f6f1af61c21c63f8fe8d35889d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081251, "uuid": "b29fc05c-2dcd-4ee5-aef0-340900b78044", "value": "T12E0518112F64C26BC8BE4277F0A5403DC7FDCC0A5297EB0E5C863CE96A867619B17366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081251, "uuid": "af20c051-251e-4523-a13d-019e5247033e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081251, "uuid": "461b04f2-2270-4831-9ad8-d2ee98156a25", "value": "12288:Dy9/lMaLbky9CMYtgZelJcM9UJ/NS1NabT2OQyV+VM9fJL7HJW:D2Sa3kylYlq+1NaX2u+2J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694081251, "uuid": "7c9f9dd4-4d82-4980-813f-da8d9d4ce737", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694081251, "uuid": "1649a054-c15c-4f20-b50d-76af92246b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694081251, "uuid": "0f42e92f-5434-45ae-aedf-1e895ea6babb", "value": "ee6eb44ef159328f2802d2f54dae785f2512c421f808cdfd8eca1376134b8f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92545dbb-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075759, "uuid": "25b0cb0c-0c76-4f95-9b30-3e160c4edc95", "comment": "Malware payload (ConnectWise)", "value": "dab2490047e61106441c3264c8071f2d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075759, "uuid": "2b8c0f48-a64f-493e-b92c-a64381d6b288", "comment": "Malware payload (ConnectWise)", "value": "ee91a52af6f5137e44cab924919bc9acf0dd5e2a557138677a85602f005ea525", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075759, "uuid": "4372aab4-5cf5-4210-b779-99a03651cb03", "comment": "Malware payload (ConnectWise)", "value": "0108e05aa3094120e64c204d2239d358ff848186", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075759, "uuid": "c12684d9-d7c0-4f4a-9787-3311d7eceaf9", "comment": "Malware payload (ConnectWise)", "value": "e1553ecf5f7e06873826a164e75959dc23d660b5abe34ed9645b4c4b6679149bc8d693338042eafbbfb16df5c7950f25", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075759, "uuid": "568b5cd4-6878-457b-a4fa-09ab11f24a0c", "value": "T159836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075759, "uuid": "abc6be56-204f-4df5-a65a-4eab08d160a6", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075759, "uuid": "e41cdba6-394b-415e-a4a8-4c985f154379", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Wk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075759, "uuid": "1c858da6-c432-47c7-9990-70f90126e764", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075759, "uuid": "a22e9aec-abd9-4fb8-bd13-26cf2d7b93a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075759, "uuid": "272e7eec-dca8-4a50-b2f2-0935ae74d7fc", "value": "dab2490047e61106441c3264c8071f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b185b69-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075720, "uuid": "b2c634c5-9227-42e2-b31d-8216818428ba", "comment": "Malware payload (ConnectWise)", "value": "a084c60c25f82385de7cd13b0da4bddb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075720, "uuid": "8bb03479-ab11-4c84-bb2d-0611c9a571cc", "comment": "Malware payload (ConnectWise)", "value": "eea5efdd6cf79a70399d9ca30a2e2bcf99f5943b3f6bb5c74f79747038459507", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075720, "uuid": "ad5f18a7-34e0-4aea-90a5-abc460b051e9", "comment": "Malware payload (ConnectWise)", "value": "41447cea59292616cf7d916987c465266270629f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075720, "uuid": "6a92583f-7086-4b26-a673-b9bf84126651", "comment": "Malware payload (ConnectWise)", "value": "e607b569204694c695b0fe448d28723c3f710fb2d1e0f8f622ebb987962f7a259e6b28ffe726c18b1df684d340cfb265", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075720, "uuid": "f385b5fc-6ec0-4280-aefc-9a161f60a429", "value": "T191835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075720, "uuid": "4ed514df-d4d9-4e08-84b2-1eda9ea74889", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075720, "uuid": "a32f53d0-1d68-45d4-be40-40d0d9c17d9b", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Gk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075720, "uuid": "76811ef4-00e2-4eab-a500-46778c1ae282", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075720, "uuid": "2f312b1e-50df-4829-8ee2-1b553b586e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075720, "uuid": "3dd1033e-cac0-443f-b118-ec58502a1661", "value": "a084c60c25f82385de7cd13b0da4bddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6832c925-4d4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694069246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069246, "uuid": "04088194-b820-4f67-b62d-abdfb2429798", "comment": "Malware payload (AgentTesla)", "value": "0c132892597855f142bba5f5812d9afe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069246, "uuid": "c1699587-f6e5-42d0-8f96-5afb2ed013d9", "comment": "Malware payload (AgentTesla)", "value": "eef7c8aaab8708563b10a4cfb74ff6856deaaa7ff0db4d4bd7cb709fd8103b1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069246, "uuid": "b24606d1-f991-4afe-ab5a-3b9aa5c913cb", "comment": "Malware payload (AgentTesla)", "value": "7b84eaf37baf98ce5e3839da50e6e6016c8c90af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694069246, "uuid": "99bd74d9-8494-4127-9ef3-a35d8a5f072d", "comment": "Malware payload (AgentTesla)", "value": "14f6269d6f06969c0004bcf2b38a7bf6ed103b6dace1045d1261b3acf09a8a510c05f4296012c207720a61131969a3f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069246, "uuid": "5425bf3c-b20d-4e11-9988-54a4128e4fee", "value": "T19EF42370EF63986EEAD3A0071618A047D95626CDBDD13C27CDB466EF9AD3EB0E09C045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069246, "uuid": "486c48c7-edd1-445e-bf13-92252db5f8d6", "value": "12288:jC7XhU5QOLJ+w1OCsQoRfEoQ3eercb1stxln1vyY3r/4v7QRSTIT19eBgJ:YXyQOQwpJoBE9uYeCtxF9yY3Li7hTM1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694069246, "uuid": "993040f3-bdf1-4e00-bb30-c9641ada37df", "value": 751029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694069246, "uuid": "757c790f-5d0e-4061-a58c-3e997bdbe674", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694069246, "uuid": "1a480404-48f7-4017-9600-05b7a3de6c50", "value": "New Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186287ea-4d83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694093594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093594, "uuid": "6d1c14c4-c36d-4f2d-8560-e491fd3ca87b", "comment": "Malware payload (AgentTesla)", "value": "3fb4e744e88ce97e027071470a12e23f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093594, "uuid": "086b7ccd-52f1-4896-a3bb-5ab687e0cb0a", "comment": "Malware payload (AgentTesla)", "value": "ef64bf88be50dcedfb18bb1310109a48940ef5e434e3c83b63a7fa6b2a78fe00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093594, "uuid": "ef8622b2-4afc-4431-9886-c258124db43b", "comment": "Malware payload (AgentTesla)", "value": "724c210b8dd73ebf4226bc783b685a0ccced3ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093594, "uuid": "015895b6-739e-4ee4-9145-bdeed98e4dd0", "comment": "Malware payload (AgentTesla)", "value": "7886b5ee262e881740ea3bd7ffc914a4b7aab2bc90dda41f85cdb3afbb05ec816570a00215ae27d3a8cc2d418326c330", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093594, "uuid": "69904380-41a1-4d89-ab14-1154a217ffb5", "value": "T147E4E0F818A6C3E2E33853FF52A794705A277E42617143CD773D76484EA9AC70826CB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093594, "uuid": "475ba111-5a4b-4692-a0ab-accfc3c97feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093594, "uuid": "e87ef5ce-8c7c-4143-b4aa-dcf88f01b0d0", "value": "12288:Gx5fVsbR2I5Kh/ghUn9Q9EZIcIMaCibQFLePp5P9kXFB28VRIaL1SeouP:GxtO2I4h/gUQ9HcIM9zypyB7IHeou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093594, "uuid": "71efa6be-ba3f-402f-acb6-c01e1a393752", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093594, "uuid": "50686b5c-7070-49a7-804f-5f8989dedae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093594, "uuid": "b1faa025-bc8c-4441-84b0-2e143d95cf74", "value": "SecuriteInfo.com.Win32.PWSX-gen.3401.536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc415d96-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075830, "uuid": "e0c9acd5-d5e6-4244-874a-af1018e1f881", "comment": "Malware payload (ConnectWise)", "value": "fd3226027b3d69162375c95cc0914279", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075830, "uuid": "84b6fad1-a062-4575-b78a-00b71752859d", "comment": "Malware payload (ConnectWise)", "value": "efa25225ace61471959814b2043e130aa9536bd78dd1504f11a6d74c3fad1575", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075830, "uuid": "68a55e0a-331c-470f-a32f-17dffa35d4f1", "comment": "Malware payload (ConnectWise)", "value": "029448fb7c404bb47c6f89d62f53f0f3d4994e47", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075830, "uuid": "a7a62869-bd4a-4446-a86d-732ceadb46fd", "comment": "Malware payload (ConnectWise)", "value": "ad8394d0879591d86dae0091eb8fd3345e427dc4a40119bbca220ad1ff3891415809c572c5ece8a6a273d04e6548715a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075830, "uuid": "e9ff0147-69fd-4f26-9218-be43ade47d30", "value": "T12C836B13B4D18475E8720E3118B5D9F4593F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075830, "uuid": "9b34ef5c-af34-42e1-a26e-d3ac300ad890", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075830, "uuid": "648a878b-e246-4883-b1c5-5a5188fa933d", "value": "1536:mazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYh709Px30SD:6FNpo6rIKlUE8fbkqRfbaQlaYYhYxESD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075830, "uuid": "c25be34e-d0bc-4921-8161-6be0c1548011", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075830, "uuid": "2d4a8115-bb3d-48cf-b693-4c0a7b4d7d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075830, "uuid": "06b68c0e-ec4d-41ad-ad46-55147c704d95", "value": "fd3226027b3d69162375c95cc0914279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fc4933-4d97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694102443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102443, "uuid": "49f49d18-7758-426d-ac94-1bc8433a6be8", "comment": "Malware payload (SnakeKeylogger)", "value": "8a5e246ab2d969744ba1ff723dcdb8ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102443, "uuid": "8e1d4c9d-ff60-4b41-8967-31bf4bb786de", "comment": "Malware payload (SnakeKeylogger)", "value": "efd6170875cae66b14b031f44ccf37a9e75c1e11ca84741146c9d723aab75778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102443, "uuid": "03822c92-6ce5-4bd5-8d2f-85c1adfab578", "comment": "Malware payload (SnakeKeylogger)", "value": "8d628619550b4257dcdf224b668898b523d8a251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694102443, "uuid": "a13013e0-af64-4af2-9337-f6f53b7a5c3f", "comment": "Malware payload (SnakeKeylogger)", "value": "9957280e650ab1be57dd2a4e9be913037d295c8e889fa3bb4e428417121f2f3a54d2069844e1c5355041f8beb186de69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102443, "uuid": "7620faca-4dd8-411c-9513-1dde474df2c3", "value": "T1E7B4DEF960A6C3E2E7B497FF516B9438AA277D45243053CD377D39840DA5AC71822E32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102443, "uuid": "21f90bea-04ce-4589-a630-b7c95328e922", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102443, "uuid": "fac20626-5e50-47ac-b8e8-80f83c0fcd7c", "value": "12288:M5fVsbR2Jq94XKP5PLszmpNThcnJjyB5CJ7fpncAm:MtO2Jq9aKPZLlxh8xyBc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694102443, "uuid": "eee47fcc-6e1e-4a0b-81fb-fd6a04f5fe37", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694102443, "uuid": "016d773b-96fc-4a10-8530-1e9667fb0e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694102443, "uuid": "6e789f7a-22f0-440e-a63e-31031ea21d88", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426dce36-4dc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694122440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122440, "uuid": "2c0bc258-9180-42e2-b7b2-36eae3ccdeeb", "comment": "Malware payload (Mirai)", "value": "d5976e95c038680559939dd467046437", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122440, "uuid": "ed83a7a3-2b90-4350-951b-db6f28f4588d", "comment": "Malware payload (Mirai)", "value": "efdff6c19bc0411db994905753c434cfbd0c22613fc664dad56e2adfa0407d29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122440, "uuid": "3fb08b0d-5d6c-481f-912f-2b29994066e4", "comment": "Malware payload (Mirai)", "value": "12a510ef63fbf573a86b8b0ede482aff889a415f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694122440, "uuid": "d39f717c-514c-4a24-97cb-a4e16c1dfc66", "comment": "Malware payload (Mirai)", "value": "e8ecfec30ac7bf0955c6ce5fb59accd6103bbce96a3f573b6ac9004db17d0075cc91935c66ec79cf72c86e4f72e0d721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122440, "uuid": "f9538926-1c4b-4db0-a6eb-5686e8d41702", "value": "T15F432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122440, "uuid": "b1e59e08-4a15-4634-877a-3b368ce1891f", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwr:RqtmZPuutfbltZFBSJsBcfDSTFI+BEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694122440, "uuid": "f7f0ede1-21c1-49a1-ab3f-5054cb3de4d6", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694122440, "uuid": "b92402fb-d63c-40e8-a212-16c3402bbaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694122440, "uuid": "a7fae82a-2122-4f38-91d4-6846aba8f929", "value": "d5976e95c038680559939dd467046437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3338a6d9-4dd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694126710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126710, "uuid": "fb0afe93-9d09-4426-bba1-33c836488d16", "comment": "Malware payload (Loki)", "value": "bb68999dfb1432095567d4edfa4ae321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126710, "uuid": "5cf9a86c-f87e-4987-aa2a-dc265c9fcc50", "comment": "Malware payload (Loki)", "value": "f0640d522e829ff6161146286a97052ab807116b832d669095f7ec2251dc8e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126710, "uuid": "92d43dd9-5434-4719-ae6c-223d77f6f8ca", "comment": "Malware payload (Loki)", "value": "04509c626d00152a9b9aa0a4550726d395020bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694126710, "uuid": "47ac94d2-cd35-428a-b61d-5b62b6f52327", "comment": "Malware payload (Loki)", "value": "bd20b5ef17bd7a26522545b101da55d76e4ab2c6dae1ce7fe5ddf2dc93f7e6374fbf3bd5e294c69452ee6c679be4b73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126710, "uuid": "cb68a792-46c5-4dc1-b90f-ad6c97ebd338", "value": "T1FF645C1392A3A861DD274672AE2AC6E42A1FF8E14F5577EB13549EFF0C701E1C672312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126710, "uuid": "a4966390-ffe2-4e55-a1cc-5ad8704ac079", "value": "badfd3002a7785754765042ffe6b2bf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126710, "uuid": "845b1a73-ceac-43da-9028-dd2c9be482bd", "value": "6144:8oO+fLZQeXnlb0zgM7Ao5lPKKB9WUGoy:fiCnlYcM0cKHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694126710, "uuid": "fb9ca7c7-b9f1-4939-8a0b-f0644b9c439f", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694126710, "uuid": "45418765-f713-4421-ae25-c71b8cafb84b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694126710, "uuid": "f4515d83-ff56-476e-a5cd-e6bcaa9ed7a3", "value": "SongHong BankSlip+Statement.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a494b00b-4d78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694089104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089104, "uuid": "e55e0f8e-47e6-4982-80d8-6285fdd53ddc", "comment": "Malware payload (RedLineStealer)", "value": "439707cc204edbb4d613934f560af3b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089104, "uuid": "0521b3b2-5a55-4b1a-aeb8-a5cc1038317b", "comment": "Malware payload (RedLineStealer)", "value": "f1317fa1e70ad44256d1282121c8ad5e12faf9a32fc6b743212726d666408967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089104, "uuid": "558823eb-b7ef-4a51-b02c-6cf7273fff1b", "comment": "Malware payload (RedLineStealer)", "value": "3fe92fb5db7f20498dd254b8f1ec1bb083fc0216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694089104, "uuid": "aa59978d-8a80-4014-9a82-22ee712d34ab", "comment": "Malware payload (RedLineStealer)", "value": "45bc5e658a19452943734ee4439ac5ad810f34917d0c0a7b81ad25be08de8138b94f795c490a29607dda27eb38971600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089104, "uuid": "49f1282d-c463-4ea2-ae17-48534df6af4c", "value": "T1EA244B1A7C73C7F1C7E1C2F5D8E840A0F024F8541296F29BF5985C2ADAA39DD529229F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089104, "uuid": "8b5e1911-757b-4783-bccc-495496d68966", "value": "d281318b087326c2d4cf3480c3ef44ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089104, "uuid": "87c0b3ef-1271-4bfc-b8b4-a9b1ceafe701", "value": "3072:c1adNFF/NTC6yPVv6UXqMtM+FKIpZbdRrFEuVRBKm1XQk2ryl3qwZUbo:a6PF1TY6oqKbV7Km1bzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694089104, "uuid": "52341997-a41a-4cca-9426-a122069cfeb7", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694089104, "uuid": "f0228d9d-a19e-4e12-9b9b-a938af1bd58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694089104, "uuid": "3b73b141-9ad5-404b-ab89-af62eb7bdaa6", "value": "f1317fa1e70ad44256d1282121c8ad5e12faf9a32fc6b743212726d666408967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6da4c8-4d83-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694093597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093597, "uuid": "5db23a33-d93d-427d-a636-fa1275bf0728", "comment": "Malware payload", "value": "d88bbe646906482cb8db81095b9194ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093597, "uuid": "c2b3de5b-5887-4e55-9763-ecaa8aeca290", "comment": "Malware payload", "value": "f15d68f0bd92098f7c44c191475abc00ebae42cbef51814f69bf25657730c4ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093597, "uuid": "14db9160-15ad-433c-b979-29364597371b", "comment": "Malware payload", "value": "9eb94a4dcf9e6195472a42dbddab1827560f025b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694093597, "uuid": "4ed53eae-9645-4491-b5d7-f0e7d85ec3c9", "comment": "Malware payload", "value": "c34b1ae1c8039c43ebd86d96816071566f0571b56d4b382400e4e058d5095fc57272637e7f60484a88573d6c978881f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093597, "uuid": "832da912-cdb0-43fe-bc5c-5e5632b9885b", "value": "T1D616187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093597, "uuid": "868ff2c7-e525-44ef-85df-64bbf8ea343a", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093597, "uuid": "744c220e-9b8e-46a6-b702-d9045ee059c1", "value": "49152:lgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWPjXNO:xa71fLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694093597, "uuid": "f5031247-b306-492f-9a53-44a657a7b3a8", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694093597, "uuid": "022dee69-3e3f-434a-b5a9-35be5f44b4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694093597, "uuid": "3c8b452c-1453-43ac-9941-f9eeac00800f", "value": "SecuriteInfo.com.Trojan.Win64.Delf.6740.17946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b06da7-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075741, "uuid": "d7d15432-202f-4dc3-a5f5-a8febbea25b1", "comment": "Malware payload (ConnectWise)", "value": "b880b17252e144eab59ad10c2fdfb961", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075741, "uuid": "a3010b75-ddae-40f1-804b-eb60fd34cadf", "comment": "Malware payload (ConnectWise)", "value": "f245cbb64e9bb5bd373321b2c84e2d1ec220a69925dafd449237afde21d9db66", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075741, "uuid": "7fa972e1-7765-4b1f-9eb3-eb022f9491f9", "comment": "Malware payload (ConnectWise)", "value": "09a66f90af296039309cb5fcb61e4718e1a660fa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075741, "uuid": "32a171e5-a2b1-4bf2-8517-24266911be92", "comment": "Malware payload (ConnectWise)", "value": "49a2a92b1baaa58779e4c0c08d089ebaa1439b334e7acb48b8e4667f2f7bbe749c0d463d5c9ebcb82229573751b80264", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075741, "uuid": "92ad5182-4a82-4bf2-a545-95750ea7a130", "value": "T1E6836B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075741, "uuid": "22988e75-9d30-48fe-a1f5-0260e3b07887", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075741, "uuid": "d2b7d59a-e5b3-4e78-9234-f0643b27d5d4", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Sk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075741, "uuid": "34c8f9be-8437-4117-8c20-2d6a94bb0692", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075741, "uuid": "e2d42967-1bea-447b-af34-d1bf4b0f6a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075741, "uuid": "b880e5a6-583a-4e8f-9b0b-6bba3bbb3ab5", "value": "b880b17252e144eab59ad10c2fdfb961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf0ccb2-4d85-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694094752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094752, "uuid": "a9406dc9-30f9-48e3-bdf2-9b637ae4cea0", "comment": "Malware payload", "value": "0c4ff243929ee3d8605ba77e572e1925", "object_relation": "md5", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094752, "uuid": "eac7b851-23c7-4a56-bcc2-558758f20e65", "comment": "Malware payload", "value": "f25cbf1d159153193b26beac27351ab47f6646b730e67486d5861a14867e6635", "object_relation": "sha256", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094752, "uuid": "b9d58476-92cd-4ff4-9859-227cf5bce604", "comment": "Malware payload", "value": "63225a636df7c1e07312617294243a7fc534647c", "object_relation": "sha1", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694094752, "uuid": "43cdb5ca-4fbb-42dc-9db8-40d5e7170c82", "comment": "Malware payload", "value": "a9c194b3f204f5e23de3af59c21e4f8dbcc4be44539497b33519d647136443dbd0d10ccfe946c0d8a83a186392f36b94", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-178-51", "colour": "#8D1637", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094752, "uuid": "1ae6a246-0df0-471b-aa67-72f3f5d22779", "value": "T18701DC05160FFDBF1847F3C6B67406902FD36040EA483631A7455C2F9E31C3885CE884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094752, "uuid": "a2589ac6-4bc1-4e02-9d3b-105de803a359", "value": "12:BaAxS2hz7YU+Sj8zlBGSGpbjsz3lnxfTUtZ7+DP981E7GXXfDWss1CYur+uhrHD:9I2hzEPI8zlBapUz3lnx7fG1fXXfDvsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694094752, "uuid": "c1a3a49a-751b-4eeb-b106-b8941fcc2156", "value": 754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694094752, "uuid": "2398115c-b72c-470d-acbe-7e733e31cffd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694094752, "uuid": "eec3b405-a97f-44dc-a3a2-9da274c43725", "value": "Client32648.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc166c65-4d7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694090862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090862, "uuid": "a61f6666-665f-4d5a-9a96-7d646c169981", "comment": "Malware payload (AveMariaRAT)", "value": "1c355cd055767e8141fb6959ab3a98aa", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090862, "uuid": "afa3d67b-b2c2-4bc3-adca-cb2044b2e5d9", "comment": "Malware payload (AveMariaRAT)", "value": "f26ad126464da99c98b042f79db61dc036724c9baeb90b7c14d3d70576229c2f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090862, "uuid": "dce379ee-9a54-46b2-ba4c-68ce371bb61e", "comment": "Malware payload (AveMariaRAT)", "value": "066c6768be6dbf3eee8493ed3cbea4f135f0e954", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694090862, "uuid": "e74c982c-4fa8-44a6-92cc-a1422205fd03", "comment": "Malware payload (AveMariaRAT)", "value": "9659e09b2136de8af69c77987f5ea3d9121733330cadffb2f61ff63b48235b5c2a72dcbc568b09af8af6dd0ec6c9b556", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090862, "uuid": "ded6214e-06e0-4036-b9f6-2a78ab63bf62", "value": "T165E37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090862, "uuid": "df4f0bff-dbf9-46fa-9aff-64b81a4da6df", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090862, "uuid": "9eaac2d4-9ae8-4dfa-a7d7-57e1e66f3161", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694090862, "uuid": "fca149eb-8b08-4aaf-b0b3-fc7ca0526bcb", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694090862, "uuid": "b01205dc-05a5-4959-8f88-66bc2d83647d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694090862, "uuid": "b96470c0-b534-498e-95d3-32f930af45a3", "value": "f26ad126464da99c98b042f79db61dc036724c9baeb90b7c14d3d70576229c2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2581ecc6-4d23-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694052384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052384, "uuid": "e8020c00-0388-448d-9761-f08d463a78d1", "comment": "Malware payload (Amadey)", "value": "a0ad854cdead1c8fb2454ecede8ee276", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052384, "uuid": "f9455e01-8e29-4633-a8b1-64f8b695a368", "comment": "Malware payload (Amadey)", "value": "f2da398d70213cb07546e9308830f2d182a32ac0072015f44c7f0fed2974de31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052384, "uuid": "05b901dc-e8c0-4c88-8884-865325df3ec6", "comment": "Malware payload (Amadey)", "value": "408dab57b1753a15806f7c13c4d6201bc80c3fde", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694052384, "uuid": "474e1fc4-751e-4ae2-af28-9c2e7a6c5237", "comment": "Malware payload (Amadey)", "value": "74ef4809f2e8facfadf913bbe8d3123f109f71d5b94b6cfd96c6bc94489cc1138aeb3b4f17b73a5160acf199fec894e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052384, "uuid": "5ddc5f01-1f29-4880-ab86-a032152e66c4", "value": "T15124F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052384, "uuid": "323b269a-539b-447e-9e14-9188e64fac1c", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052384, "uuid": "3592eb13-fa11-415c-8b88-3c8387fd81ba", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694052384, "uuid": "d6b415cf-a750-401b-ad88-b0f1a76092bd", "value": 225404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694052384, "uuid": "166e2170-9874-480f-ace6-1ddc2640ffc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694052384, "uuid": "a270c315-2452-4088-b1cb-bfcb34271a02", "value": "a0ad854cdead1c8fb2454ecede8ee276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb062d26-4d6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694084525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084525, "uuid": "5c4d2ed1-b8f4-4054-b4cb-af9dc7e8253f", "comment": "Malware payload", "value": "a1e3d75337aabe373cdcf2b8df62c254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084525, "uuid": "b453f29f-7072-4686-bb11-a4702d4c9c76", "comment": "Malware payload", "value": "f32e1180e03fd664770a24e99b2c970a0f8d498f039a194c9c347bd6dd6b43f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084525, "uuid": "3354541b-0b86-49f8-8a1d-b4521f74d57e", "comment": "Malware payload", "value": "81ecc474de146f98c8bc0acd0bab5c7697248e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694084525, "uuid": "bdb6f449-18d7-480c-9936-7ac003ff82b8", "comment": "Malware payload", "value": "89698139e9c48b80eec43f0b94727a630f098c062ef33a05963fcebe17ee2dba3737b90b6cd3b6616ae19bfdb0bdda03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084525, "uuid": "563d554b-e84f-4922-bd4f-e0574290657f", "value": "T124C192B222AA3004C04642B61861D1B8AAA0B60548878202BC5EC6E520025C75612AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084525, "uuid": "365b68e8-9e23-4c23-b4fa-091138199d51", "value": "3:Okp/lNlDll0nClkXlqUAJIXDDEIFqRYEqKYFmVvoKEtISv+ECl1111111111111d:d/9ll0nC6qZJIpp8YKolISvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694084525, "uuid": "5cfc0c29-15db-4089-9876-29ecf8ef033b", "value": 6023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694084525, "uuid": "8289f830-d80e-4dc0-8d67-37e55e795fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694084525, "uuid": "00a7ca77-7bce-4e98-bc04-f34eda544f48", "value": "murphy.tormentor.1024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed10c675-4d58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075482, "uuid": "35463b3b-2d45-40ad-a3d1-bfca0e9b4e9e", "comment": "Malware payload (ConnectWise)", "value": "e488b017d753608fcb43dc43541df0ab", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075482, "uuid": "47498313-c40a-4b65-b166-873190a0c6b0", "comment": "Malware payload (ConnectWise)", "value": "f335f3135a0e776bb31d753a388530839ff255f273feb100d104b5749d80c7f1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075482, "uuid": "cef6977e-5f31-465f-9235-522cb1a5ad58", "comment": "Malware payload (ConnectWise)", "value": "a47955acd2d32690f12df4bc3f893c45383ac75e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075482, "uuid": "198d68f3-b8a8-4168-9907-e13d191fd0a6", "comment": "Malware payload (ConnectWise)", "value": "cce4d274eed272ae7bf3b7662f33bdf73b819e6e3ee0978e35dbce8f9f3a8cc8dd4bec4a7764c3aaf5caaaf19b868579", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075482, "uuid": "e882fe64-8e23-469a-a8ab-5bf96305f29f", "value": "T159837C53B5D19C71E9721D3128B1C9615A3FBA211E348EBB2398026E4F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075482, "uuid": "2bda404a-f08b-41de-99b0-4105ac40aba9", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075482, "uuid": "cbb14c04-561d-45a8-8345-387f321efbe7", "value": "1536:fXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWbna:fE3x5KBDYiKWm/iSw0fRMvyg7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075482, "uuid": "172fcddf-416a-4aa6-84b3-190028c1f33d", "value": 87760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075482, "uuid": "3ebb9dae-45ee-4625-ac57-22bc0c467c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075482, "uuid": "3479eff7-5e8d-4618-b326-94111388e77d", "value": "e488b017d753608fcb43dc43541df0ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd468e8b-4d5b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694076798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694076798, "uuid": "29e4303f-760c-4ba8-9081-91299a795b9f", "comment": "Malware payload (RedLineStealer)", "value": "e7bd0432cb16de765feea0b46ebbce1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694076798, "uuid": "75fc4187-91ed-4349-a066-8c90a987631f", "comment": "Malware payload (RedLineStealer)", "value": "f353607f3c6a01bc5e2ee8b7335157f2e68f5d129d77fe16ff0fe393d61a5f47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694076798, "uuid": "d8c64d70-84c1-4478-bc6b-8402a1d4a9d6", "comment": "Malware payload (RedLineStealer)", "value": "5aea784187e87a6c3ad4746a0a6e2dc54922f11d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694076798, "uuid": "39a62b68-e301-4900-9904-edbfbfa61016", "comment": "Malware payload (RedLineStealer)", "value": "652279b381a6dd61a0e3a377e7adc02f7ffb4914672a5eb0e5e80dab92e4cd6fa7f401efb9fb68f4170ec9f8069efc85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694076798, "uuid": "8c695305-4aef-4301-83f1-6808a35c962d", "value": "T14FD41211BAE85173ECB91B306CFB03C70B3A7CA15D7846AB2B65A84B5D725C0593273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694076798, "uuid": "0dd68eaf-ec20-4754-b1f3-ce5720effecd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694076798, "uuid": "cd64920a-5c0f-47e0-b388-df245b2ff71e", "value": "12288:OMrry90P8FyllNHZlnN6NZc225dk1m1FIU1b1jMGmI6jh:1yG8F4HZ/6Idk1eIU1Bujh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694076798, "uuid": "b26d2622-cd15-4719-a5a0-950de6b4e3b4", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694076798, "uuid": "0e9e7ec3-582d-41a3-b0c3-ea3a05e315ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694076798, "uuid": "fa8d86de-18de-4cbd-958f-1612378bef07", "value": "e7bd0432cb16de765feea0b46ebbce1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93e11df-4d69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694082777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082777, "uuid": "84797b5b-e3f1-4e51-91f8-0ca91dfaeac5", "comment": "Malware payload (AgentTesla)", "value": "c06870659f98ea5dfdd8cf59c88708c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082777, "uuid": "54486b41-a9a6-42c9-8df2-daf69e9cdf9e", "comment": "Malware payload (AgentTesla)", "value": "f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082777, "uuid": "5ae6beff-31e1-4c8e-aa70-943f24f91974", "comment": "Malware payload (AgentTesla)", "value": "9a9586a28d4e2d2db3b31858dfdb296a66d27def", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694082777, "uuid": "b7d92611-be30-405a-87e9-358c4fc24781", "comment": "Malware payload (AgentTesla)", "value": "a3a1905227085f6afbac6bf413dc986828c63103f5954b0a8e034afce1ff4a5ee9747ce348b3ffb3c90b2295324660ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082777, "uuid": "18bc5c34-07e9-406a-827f-fd44d0218514", "value": "T17324F1147B4AFB6DE4288272501770C16738E26B4816EB0FB9CD97ECED42DE89550BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082777, "uuid": "fdedb071-4419-45d4-afe3-edf4fc7ebc9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082777, "uuid": "9dff2f8f-248d-427f-8003-06e5f9ab5c2a", "value": "6144:McqEvGwh0m1je9VNB1EUL4uYgHhMgZ3C15sFSHtZsBGnUyFw+kPaD:McqEuG0m1jcNB7L4uYgB/ZASFSHtZU+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694082777, "uuid": "2a2b7873-6895-4d17-a831-622271513da8", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694082777, "uuid": "a43a6e8d-82ef-4c5b-8090-ca88107077e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694082777, "uuid": "59642bec-9c70-4752-90dc-31fc58075a85", "value": "f53be2a63c3bc58b077bd3a4816bbb3e1df72ed64ffce8720c2fc7c3485dec41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef515e9-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075646, "uuid": "c7e5bd46-5753-4f32-863b-33541b141850", "comment": "Malware payload (ConnectWise)", "value": "250a42cdaeab499b2bcd1061d69bde16", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075646, "uuid": "910f3e11-be4e-4b51-aced-b26949006640", "comment": "Malware payload (ConnectWise)", "value": "f546e0f1e1a1863f7268c01719f66b671cfc46f6b10f6a72d369a84e235d54b5", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075646, "uuid": "eb24265d-3b3b-4081-be39-4e52224e4f6f", "comment": "Malware payload (ConnectWise)", "value": "4258d45d9ce462393dffb1ed3e8bf96a2351f6e9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075646, "uuid": "d7f25e29-ed85-4230-8395-6cebede89b41", "comment": "Malware payload (ConnectWise)", "value": "b20f09128c62eaba04fe2167b4b9ccc59afd02e84e8a203ccfaca1220a895ecb7d8dd3875363608f9b4e5637d8d292b2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075646, "uuid": "55a74636-fb02-49a0-b736-ee3de7203893", "value": "T178835B13B5D18475E8B30E3118B1D9B4993F7E114E648EAB2398427E0F351D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075646, "uuid": "14b8c3d4-3d9a-4a92-91f6-ec095a08ad8b", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075646, "uuid": "646fcd49-347f-4126-b158-6b5bedd065d0", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3Hk:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075646, "uuid": "1bc1fc68-a010-4eb7-bd4a-12952ae17e1b", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075646, "uuid": "5c5f1051-34f0-45f3-92d4-36835d686e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075646, "uuid": "f7a8e468-6f12-4fd4-8eb5-31a53cf75744", "value": "250a42cdaeab499b2bcd1061d69bde16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cbdf3a-4dbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694118852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118852, "uuid": "1771a721-d978-4d10-8335-623557cbf8bf", "comment": "Malware payload", "value": "702e4ca19a5ffec45ac9a448bc3f15a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118852, "uuid": "a9d523e7-1258-45a1-91f9-6bbd8ef08ae3", "comment": "Malware payload", "value": "f5fa32ba8a1ec41e617b895dc966494a12e2979a6bbb6f8178fbf312a0a97c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118852, "uuid": "1a2aed6f-dfbc-409b-8724-065be81f88a8", "comment": "Malware payload", "value": "622f0b4b3fc8000fde237cefc9ea8628bd718b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694118852, "uuid": "cf1be3ca-14e0-4eb6-a638-e89f4b684de2", "comment": "Malware payload", "value": "401f2fad808275d1a31160489ebf9ddf466978f08127807bd28716262515a5f1b58f9cfc02aec77a34b432dc17eeee8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118852, "uuid": "031ea920-64c8-4071-b041-4adbfc25ccda", "value": "T10E16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118852, "uuid": "7763174c-ddd5-4824-a055-263c0b8f1200", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118852, "uuid": "aec65e61-af7b-41a5-ba9d-98fa75636a44", "value": "49152:+gh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWGjXNO:Ua71fqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694118852, "uuid": "6804c586-47d0-4b30-88b2-09f8d7a315e5", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694118852, "uuid": "beac1e3e-526b-4f02-8a15-9497bbe6b532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694118852, "uuid": "07baebcc-dbb0-47e9-986c-cfaa576cee49", "value": "SecuriteInfo.com.Trojan.Packed2.45650.16816.27434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a689ac-4da4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694108036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108036, "uuid": "e6bdb10f-9dd2-4251-bb39-093d42b6009d", "comment": "Malware payload (Mirai)", "value": "db25a04f0d838eb858b59146697daf9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108036, "uuid": "d2193ae0-7e00-4e8a-9857-680f235dbfa4", "comment": "Malware payload (Mirai)", "value": "f67f2ee63ee2b509f5add8fd0e0246e6fe8efb7ff39e918007b17e7f1246eb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108036, "uuid": "57368530-3c56-4e17-bb44-6e30c011201f", "comment": "Malware payload (Mirai)", "value": "9adea0d0edd2844d535eb5ff66d73b01dc322cae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694108036, "uuid": "4087267c-f17b-4f5d-8a39-afb36f3a2cb9", "comment": "Malware payload (Mirai)", "value": "19550dcb226eac9efb38d751c2b6b2fe94a3e33f9e22e1d7c0a94415ada5048e57f1185dbc0d83142779d6bd5590c058", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108036, "uuid": "e0a9e0b7-a4fe-4002-b8f3-0893bbc01bef", "value": "T10D233A96BC91DA0AC6D023B6BD6F64AE330163DED2DE3253EC155F2076CA90F0DA7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108036, "uuid": "0329988e-cf12-4ee6-bda7-7112cb1b337d", "value": "768:+OXXVPdAg/Rr8vSSvjCOfQbPYzLF91X2yFVGEcfurqLQG8U7aYjXWPhbb4otxBNf:Lx+g/R4vSS6bqLl2yFVGTEqUG8U7RjXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694108036, "uuid": "59725a86-5d9f-44be-bb5c-80516823f28a", "value": 48452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694108036, "uuid": "cc83795d-dc22-453e-8cce-c01cfd89182e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694108036, "uuid": "b36c52ff-b547-4b8f-bdf4-7459b1acc220", "value": "db25a04f0d838eb858b59146697daf9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356a66f-4d1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694050582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050582, "uuid": "f3d25ee4-ba35-413c-b880-2f4b805e7518", "comment": "Malware payload (Amadey)", "value": "a31401623f5b4c4555d060a59d82435a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050582, "uuid": "89bfaf8a-287f-4673-b4e0-7fbcf356b6e3", "comment": "Malware payload (Amadey)", "value": "f6b611ac509376cc570f9e9867504d2d3d8cb1de459d07439dac6ce82d85a52d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050582, "uuid": "ed9c5f03-f6c9-4ae5-a4d7-69f873e366d4", "comment": "Malware payload (Amadey)", "value": "cbe3893a55ce4cb76ab59b9698f4430a54529fd9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694050582, "uuid": "5d8d0a36-e6f2-4f0d-87c2-d1e73da2a862", "comment": "Malware payload (Amadey)", "value": "31338cee2be95a15cab057fa2204400ea83b13e6e89d6d04335dd86c28f968359332c816927121b71daf8928c4d95343", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050582, "uuid": "24a21a11-8032-4008-88dc-8a80279a25ec", "value": "T15F24F7653916C032D660A1B619F4BFF2C19DA819ABB149DF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050582, "uuid": "750681c7-536d-4c69-939e-c29b2ff7a585", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050582, "uuid": "3276911a-dc82-49ad-995b-e2f5f788f0fb", "value": "6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694050582, "uuid": "730cd7f1-d74d-491b-af2c-01fa1cf6e5d1", "value": 225170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694050582, "uuid": "e7e7b128-2f17-4451-9f9e-238e1d32946e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694050582, "uuid": "7af6b262-2145-442c-83e5-fda47a7460aa", "value": "a31401623f5b4c4555d060a59d82435a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d870e5ce-4d88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694096063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096063, "uuid": "cad34cd2-5dfb-429a-9ea7-cba763c29b44", "comment": "Malware payload (njrat)", "value": "ab6bf3d6e2da55d65cdb4fdcf31aa663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096063, "uuid": "c5d5d75b-31df-4e21-a2d1-0a51ef35cf3f", "comment": "Malware payload (njrat)", "value": "f6bff0a880ddaaf314e5da20654144241fc691abd06759bde68fcbb41cd36c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096063, "uuid": "73c289f1-397b-4c9d-ad6a-3aff5ebe331f", "comment": "Malware payload (njrat)", "value": "c41c1f4d0c58e4a65e7207c0fb5eacf8ef7ecb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694096063, "uuid": "b2c150b7-3684-4158-9814-a20df0a736dd", "comment": "Malware payload (njrat)", "value": "6e08471f2a6d09637a2689c2a42d15a1a35c9dde512761b44152e95205bd43b995a3baf32283167d908eb317ba78e2b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096063, "uuid": "ede97c7e-1c78-4e4f-ae26-a9c992679a95", "value": "T1FCE207067BE98215D6BC5AFC8CB313214772E3438532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096063, "uuid": "8e896608-cda8-4ba1-b600-870989489f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096063, "uuid": "15d8a5ab-5169-4944-99d0-15eb59807504", "value": "384:s0bUe5XB4e0XXOhbw0Q0mS03AWTxtTUFQqzFeObb9:5T9BueC55dEb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694096063, "uuid": "fb49b922-6177-4da3-8f16-2a48713c5f86", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694096063, "uuid": "aebbab2a-52dc-4bbf-925f-39ac0ee61171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694096063, "uuid": "948a33ca-86d9-4c59-a8f6-d243fec2043a", "value": "decode_fd680c03dde492b27cd2ffa2d53f6e7db7b793920d3b90d341c766d95421e401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45b7d1b-4d64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694080541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080541, "uuid": "16eeb16b-0ce8-4c8e-bb55-8bcf69c7ea10", "comment": "Malware payload (AgentTesla)", "value": "93950840639846b683571ed25c6bf29d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080541, "uuid": "70a7e161-6bcc-40b3-876b-2c98ed1e4672", "comment": "Malware payload (AgentTesla)", "value": "f71fa555840e532e32931208f483f11f05fd5f8097f9e61bc66484d97f75198f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080541, "uuid": "62c2b59f-4314-40a5-8448-b3564be2c249", "comment": "Malware payload (AgentTesla)", "value": "35b9852c518514222b5af59ceaf5eb4cd867b5f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694080541, "uuid": "eae333bf-ee3f-4175-a9e1-e413ace2ff12", "comment": "Malware payload (AgentTesla)", "value": "e565049e27bf9ad271b1d3886ec3531402a13d635954fb51ad107f0114c6b5cb43ea54928f709e95792d55f91f7e7a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080541, "uuid": "7eea2a01-05a1-4dad-b740-c9395d5f2337", "value": "T1F0348346F68492ADCC18A3B07532DE7007167EABE974645E5ACD3E673FB78F20066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080541, "uuid": "e5c20f6d-995a-415d-9e04-6738646d8edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080541, "uuid": "41be9671-8d33-4495-95b8-89fa57456dc3", "value": "3072:+T0St8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:e0SOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694080541, "uuid": "d7bdc45c-e8c4-459a-bdcf-905cd4283e23", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694080541, "uuid": "4de81d8d-0eeb-4528-90b8-984c8630f145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694080541, "uuid": "4623f209-ae8e-4097-8fa0-f8be22ea44de", "value": "SecuriteInfo.com.Win32.PWSX-gen.11266.12063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b76cde-4d59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1694075552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075552, "uuid": "68217011-cab5-4233-a80b-37d711281c84", "comment": "Malware payload (ConnectWise)", "value": "8eea66ec87dd421b2795c98654265322", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075552, "uuid": "bb523f47-f406-4347-ae3e-890e8a8e100b", "comment": "Malware payload (ConnectWise)", "value": "f7f3b02e2194b74f446c8c7c0bdfa7b9b46db7ab16918175709cb11f4fa8e113", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075552, "uuid": "e4ca1765-5bff-45a4-9a0c-f7ac972ef1f9", "comment": "Malware payload (ConnectWise)", "value": "7f6be6e54047683aff5353f0e192f64e5155815e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694075552, "uuid": "48a1778a-2859-4128-aaf3-e6f94e0276db", "comment": "Malware payload (ConnectWise)", "value": "8f732e846eaa21fef5a167bc17e96bcabb3dd5ab5060e8d3fbc07835281a1667f22fc598faf988386247d30fedb0f8b8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075552, "uuid": "9b4a39d7-769b-4830-a78b-9b09cbf20bd5", "value": "T14D835B13B5D18475E8730E3118B1D9B4993F7E114E648EAB2398427E0F352D1AE3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075552, "uuid": "f519b232-faa9-4025-a838-c113fec45392", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075552, "uuid": "69f48c79-cfce-4d79-963e-b774b51196a4", "value": "1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3/k:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694075552, "uuid": "d54b45f6-cb57-4101-9906-b70a7225d6bb", "value": 86288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694075552, "uuid": "e711a102-5713-4787-9543-cfc481b22014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694075552, "uuid": "7116a58a-497e-4403-b583-9a10cdc237ad", "value": "8eea66ec87dd421b2795c98654265322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2964045-4dbe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694119273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694119273, "uuid": "67a46138-2e8b-4536-8852-4f6d90186a45", "comment": "Malware payload (Mirai)", "value": "469764fadfd4f213e72cedc7553a2e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D",