{ "Event": { "published": true, "date": "2023-06-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-16", "timestamp": 1686960181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "957ed1c5-fd7a-496a-9316-cf4145599d2a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f26bffa-0c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686896501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896501, "uuid": "be923dd0-bdac-44f8-a957-4be9f0ca7863", "comment": "Malware payload (Mirai)", "value": "57f6b62ed3291231286446e6a08e6694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896501, "uuid": "4717b137-a8e2-4519-a6c6-70ffafbfac9f", "comment": "Malware payload (Mirai)", "value": "017e8d2eac3e96f0971e41f434b2a771bb3f9d0f6bfacf912f16fb3ca8bca2bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896501, "uuid": "9f260c3d-c8b7-4b00-83ac-6e4e65d2d460", "comment": "Malware payload (Mirai)", "value": "5784ac02eae4dc37f88a1e23e35211eb0d896e6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896501, "uuid": "1978cb02-422f-4de5-b29f-30cd1fd0dc16", "comment": "Malware payload (Mirai)", "value": "cf359e25f26209046a735123d7c8cbcda25ff28239cf1eed17af81914ce815f95cc68c84df291566fcda8606f8847091", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896501, "uuid": "44c8d48b-8ce4-41b6-86b6-76897d2770fb", "value": "T11E03F26042D8E601D62D1372A61335BB1B576F662357C6A33B366BFB9FB1075F321108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896501, "uuid": "3402445a-0425-4291-bd70-2daecced14d6", "value": "768:XbTQIK3tzAQJfaAYtIXBmkl/MDY1aNGqRA9HTTOQN0Kn:X/QcQppYpuMsvY8Org", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896501, "uuid": "b5ba39f6-5b85-464b-bcc1-4ea5f1944539", "value": 40092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896501, "uuid": "543fc0cf-2c2c-45c8-a955-f79cb97e825d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896501, "uuid": "803d0ddd-0b2d-4d45-ab38-cd3f47fc1879", "value": "wtfisyourissue.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b3749f-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897579, "uuid": "6a46f5ba-596a-4264-b834-bab68790d9d4", "comment": "Malware payload (Mirai)", "value": "ff0634c2828f79c99ff38f3b64e49743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897579, "uuid": "7b9ee86d-0c76-4c02-84c1-84a74f10f3d5", "comment": "Malware payload (Mirai)", "value": "01c85ef122df27533eb88b1e2ec911666ba933fe6a1399b7f9796d440c6dfe0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897579, "uuid": "4ee923b0-13d5-4516-b5ef-24c3d05e360e", "comment": "Malware payload (Mirai)", "value": "7a5eeece3313c4d4d30bab55b56e96e24d18aaf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897579, "uuid": "e15a1f61-ee1a-4330-a206-12ba90bcb2d3", "comment": "Malware payload (Mirai)", "value": "79b234d4ccfa4919192343e64d9340e65f5adda7e2a978da39b9b4f5174ffc487ec4f612d4d3e2a351a69cd6e55f924e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897579, "uuid": "c6f205ea-4471-4f84-81b5-50ae00ed7791", "value": "T15823F13765942832E3311DB4D1B5036D69066BF4E6FC60E91266537CBAAE38FE068383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897579, "uuid": "83c5ad6e-51a6-4844-ba00-f7bea6c32a37", "value": "768:1KF75J+7XKRHzo8DQ6fMEYhPUomj4S63gPXzy3jlND0IWFMLjdks9q3UELgw:1+75J+6zo8/fruUdj4v3kkr3kMfO1L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897579, "uuid": "7cd7a40b-bd1b-42f7-a9f1-b9c57494f07a", "value": 48668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897579, "uuid": "3b1da306-7d0c-4122-ac00-33593ca2db37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897579, "uuid": "afebab5d-7553-4fc0-ace7-95315e68c7ce", "value": "ff0634c2828f79c99ff38f3b64e49743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3331be0a-0c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686901716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901716, "uuid": "3db09538-f85c-4228-a2c2-835472464b5c", "comment": "Malware payload (AgentTesla)", "value": "e360017c7ef7884d60644094d06663e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901716, "uuid": "456b7d08-b6df-4666-8e3b-0a4b432cf9bc", "comment": "Malware payload (AgentTesla)", "value": "01d0240ca8e6371275850138ef58bb6cb4531d5ddcf37ca60e143a9c17ffcd2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901716, "uuid": "b75d5810-0677-4701-b203-f7e3370b15ae", "comment": "Malware payload (AgentTesla)", "value": "497346005f20fd716e2fde43083bfe603376cb64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901716, "uuid": "f8704ae6-6ee8-4caf-945d-909e99c13a22", "comment": "Malware payload (AgentTesla)", "value": "088a4f03d6de3d96eb11241d4358caf080bc098a0dac6e0b35e142a47923950a8994a1fac490ebd09155fb8be9490a28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901716, "uuid": "0ce42a7e-1c00-4497-b486-41842428c7fd", "value": "T115E423B6A2DB2B81658F1B7494CC6E245BC7AFC25331320178A7252673D42BF198F5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901716, "uuid": "2469252a-5462-4b64-96a5-3bbb5bcb69c1", "value": "12288:HBUDsfApPQ5fyjrg8le0yZbUSy4kXN0k4XUdLOs8RScwZmnMP/:HcsfApPC4k8le00USyjidXUgS5Z3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686901716, "uuid": "bba3b41c-a2d3-44dd-aaf2-ae77406304a4", "value": 676202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686901716, "uuid": "ffeaf562-2c60-4220-9422-45360da22e61", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901716, "uuid": "d8bcfc06-6585-4a16-b28d-92999b2d6a9c", "value": "New Order PO Pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af56377d-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897629, "uuid": "87ce48c8-1ede-47ae-97ef-74674b3112f6", "comment": "Malware payload (Mirai)", "value": "32bfc5b7aa018396931b742b04a5f297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897629, "uuid": "27ee41c7-8f0d-4a24-9de2-7b1c43e88402", "comment": "Malware payload (Mirai)", "value": "01fbe12373c8d1ce27c3da99c04c7711951f77367faa872429dd75bdc81f2003", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897629, "uuid": "7be88b3e-bf3c-4f86-978d-f8fc1a4a40d3", "comment": "Malware payload (Mirai)", "value": "8ea18a207820dfe8d8aa3c71fcc51c1e62ed5707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897629, "uuid": "d2c165d4-85c3-4d32-b621-e2a5e1538194", "comment": "Malware payload (Mirai)", "value": "67d2e13547ca6c7f29581a6901f97626dd3a6b9caa596f5fecb935536e41e1c6e65eb07bf435f2cc945c429cc4752c71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897629, "uuid": "e770710d-af15-47b2-9e0c-d0b2a89b659c", "value": "T18C23F11BE759A8D9E173F0756C6925BFF348BC92D3B38B0B10512911AE0E547EE706E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897629, "uuid": "1e6bd74e-2dc3-478a-9a1b-eb6c971ce279", "value": "768:nEUcNMh2VMhGgPGdWcb7tBexCMZHvmnwjYu4RFtPjNOEyZ/jfl3EOutIqfxvpRsv:EUM160gP5YtofjYuGtP25ftE3tF/sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897629, "uuid": "0e5862ec-1f63-40d9-93fb-11381c18b854", "value": 45584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897629, "uuid": "479abbc3-b0e2-48c4-bf75-14fb3cf4d249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897629, "uuid": "b5f42222-9918-412f-b053-55ba5fda2d50", "value": "32bfc5b7aa018396931b742b04a5f297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934b373-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914289, "uuid": "3555e26a-223e-404f-9f7b-44e17ad6155a", "comment": "Malware payload (AgentTesla)", "value": "47bbcc7603e9979b6dd4e9b4a50042f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914289, "uuid": "14a80e01-1a40-4622-b2ff-989b1a2db857", "comment": "Malware payload (AgentTesla)", "value": "023587dfb8efcb39cb353a413c2773cfded347e5d8aec8086ececf395725237a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914289, "uuid": "1d739195-cbea-4e02-93c6-104cfc4e5017", "comment": "Malware payload (AgentTesla)", "value": "ad926408828c4798c897a3eb2ac993be28fd28ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914289, "uuid": "dfa42320-b67e-4e13-9ef2-6b3d3178fc4b", "comment": "Malware payload (AgentTesla)", "value": "cf2722b7b834c72c92285f3d1f1b4b0b518c47fdf78e98e471bee5ae1e666473f10796697846581b24bec33cdd472df1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914289, "uuid": "65c430bf-4b4f-4899-94d2-e801d9df1da3", "value": "T1DAE51202F89468BCC9C2DFB946932A15941E7C5EBC8E540463963B2D3233BF7976670E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914289, "uuid": "8fed89a4-6903-45d0-874d-8f699a2668d3", "value": "98304:Aor+AMF11Rtk25B9KheI8xC0sEFzwMpLte:/0/3Rl8+wMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914289, "uuid": "ac7101e8-8375-47ab-b28e-19603bb3638c", "value": 3190784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914289, "uuid": "c34a47ce-e53d-4214-888b-6a0cd611dbfc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914289, "uuid": "da90b2ef-f8a6-48cc-a1b0-8faca3dac4db", "value": "Payment Application.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9d9563-0c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686917197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917197, "uuid": "22c2677d-9c87-4d31-b807-1246138b8661", "comment": "Malware payload (Formbook)", "value": "e4095c2e57b0656d209f4b2bf4288736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917197, "uuid": "bc9bcf1c-d7a5-4ae7-a8e9-69f8250b4679", "comment": "Malware payload (Formbook)", "value": "02dc237cae6224ab8277187f6574215e15b4ddd4bf5b2bddbedaa95fc077e4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917197, "uuid": "ac95c164-230c-4425-b850-c26341d16445", "comment": "Malware payload (Formbook)", "value": "679a9490d2625a162b16b62f31c10016a3053ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917197, "uuid": "6abf31ec-9438-4528-a74c-36e6a8190048", "comment": "Malware payload (Formbook)", "value": "d4b66bc4ec133bb33938d0560678e3679b501dd3cd1f3f0ec6770ddd707083c84e56dc44f1547d1845d7c0f92623f903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917197, "uuid": "3bb21235-39a2-4067-b720-d0fd26d5211d", "value": "T1B5F4010433B68F6AD47E6BFD09151232C3F9196A7423D7626FC329DE6D11F480B90AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917197, "uuid": "48a070b0-30ab-40db-a7de-12b74b76bacb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917197, "uuid": "0669c742-7a43-4d36-b131-49755722120b", "value": "12288:/A2iNyOe42KMu/N3mWhQmwmJCMpUJxWRL4M0OkMz4PtDlPE+elY20yE2pPrGcP4:I1wOV/NOaNRMO4V1elY2FRlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686917197, "uuid": "6ebcf4d7-bd83-44a4-a86a-2c3f272ebfcf", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686917197, "uuid": "f47be072-4cf9-40e8-a7d5-919939977fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917197, "uuid": "39cd5f12-3ee5-4d73-b7d0-8e83c5035c67", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864348cd-0c82-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686946523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946523, "uuid": "b350cc75-35cb-4a6a-9c08-8c2c331934bf", "comment": "Malware payload (Rhadamanthys)", "value": "5dfff24976bff09af4222e58f07ab308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946523, "uuid": "14316938-3cfd-4d42-b45d-fbc9f7e1d6c7", "comment": "Malware payload (Rhadamanthys)", "value": "033bebdf818560c4eba4837b7d7f29a25a0e6876dfa958c4c1dcd8b7665e4f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946523, "uuid": "7b0ac61b-62a5-42b3-ab58-aa2e132f5a81", "comment": "Malware payload (Rhadamanthys)", "value": "c457aa12b71b24b054cc1ceeb382f0f4c0e7accb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946523, "uuid": "735b69c0-b0c2-4b45-98ac-a82859c9f6cc", "comment": "Malware payload (Rhadamanthys)", "value": "f3bd55e8991f5184d614a21380c13f7bd13a8c947d45d727a2ffad9b0ccbd8492c70dd4d411e656526ee7610def497ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946523, "uuid": "8d639424-e830-40ff-9989-c5249891ed40", "value": "T10CB45B83D2B23D44EA368F729F2FC2E8725FF2518E49776D9118AB2B04B5172D163721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946523, "uuid": "488938ac-4066-4dba-a838-d1a59e21e7ab", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946523, "uuid": "465f370d-3808-4bd5-8cdc-e6163a0e197b", "value": "12288:+NrbyD3wyPjRl6NgGI7SxS2n1jj8X+FxcNZmuU:+YzwyrqgGTdnxy+4Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686946523, "uuid": "147e4744-b0c6-4abe-8fa2-abc6cb901bb3", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686946523, "uuid": "d8c9b295-2f63-4b2c-b885-012519b998f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946523, "uuid": "60ddddf6-7138-4a62-a852-7d20df2fb076", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1f209c-0c4e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686924311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924311, "uuid": "db4ea583-c2bb-4cb2-8b40-9554434861bb", "comment": "Malware payload (DCRat)", "value": "47e15cd5700a72858107bb17a3ba459d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924311, "uuid": "986683d0-c164-4961-828b-169d7d9e2373", "comment": "Malware payload (DCRat)", "value": "034941c1ea1b1ae32a653aab6371f760dfc4fc43db7c7bf07ac10fc9e98c849e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924311, "uuid": "340f593b-65ec-4470-96d2-75c798649fd2", "comment": "Malware payload (DCRat)", "value": "2515335014e8d2a1f88551997b0d67c71b6a441e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924311, "uuid": "3505321f-6eba-4c8d-908e-ff801cb01489", "comment": "Malware payload (DCRat)", "value": "33dd0e81de20dce6638fa653199c1c4191acabf9ef35cb020e661324ba90222bbf6d8eca74b253734132ded3e4236afe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924311, "uuid": "4ae7e247-dea2-4933-9e70-db174d4aec89", "value": "T106236C4037A8C136F2BD47B5A8F3960586B9D2672D03CB996CC854EE1B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924311, "uuid": "a8eecbfd-cf03-4649-92db-9d2c62394503", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924311, "uuid": "f890ba9c-593f-44d4-b277-a3ae01346cf7", "value": "768:FOEuILWCKi+Di0891aill8Yb+gX3iQNbVvEgK/JPZVc6KN:FOtm0891lzbBHznkJPZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686924311, "uuid": "f5f647ed-0734-4cf2-80bd-0403981228e1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686924311, "uuid": "e73a69ad-3010-4e09-a841-1f3b48ff9151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924311, "uuid": "17441ffd-8372-48f7-9793-2c77a9813e42", "value": "xklpsT9sBqrt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcf1ed6-0c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686896556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896556, "uuid": "e5a866af-86b4-42d6-8ec6-7f9df7b86c7b", "comment": "Malware payload (Amadey)", "value": "051f42529a14f4240e9c711c466a4716", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896556, "uuid": "9751ca50-0915-49d9-99b6-cf057e87241a", "comment": "Malware payload (Amadey)", "value": "04d8a2d915b97d7c95fdd327584939b6fa2713e237aaa8ee7b78c2f212239f44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896556, "uuid": "429664ea-b7ff-41e6-8e1c-fb2e77086a15", "comment": "Malware payload (Amadey)", "value": "be3434c3b4636530fd10f944d41bae3d3d0afbc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896556, "uuid": "ae19063f-0f0b-4237-847b-2d0400440c47", "comment": "Malware payload (Amadey)", "value": "8de3e6eb53f85e4fda60a7023ac6846edf9089d8b480d594c62744513ee20a6f924c08622d58d4f479b55ac8a6c11033", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896556, "uuid": "e425f095-b221-4672-97b5-52224f955d9f", "value": "T1DF051212D7EC85F2CDB5077048F747831B317CA18DB4632A2782AA5F1DB269168727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896556, "uuid": "c3fc2d3d-3734-4b2d-beae-baec9b11e1df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896556, "uuid": "ecbd2a5f-e1fb-463b-a4cf-b1a0499f0f42", "value": "12288:RMrGy90ZLBKQlv2iOlPOoa7+EmssAdpYV12qgs5FjDtZ242AnO1gU:zyaL7lv2iOlPs71mszdpCR5FjR2kqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896556, "uuid": "18288101-486d-460e-8d7e-92e9ef8d697a", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896556, "uuid": "4896b98a-ca96-4f44-b7c5-737565579827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896556, "uuid": "a9d78df2-be03-4797-a998-71bb940512cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8268fe3-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897617, "uuid": "19e5b40c-d8eb-444c-9602-621b7f2b64a0", "comment": "Malware payload (Mirai)", "value": "ad7b5e127a8d132848b76e049cec89dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897617, "uuid": "9a4092ad-ab52-4584-81d9-0bd153be6513", "comment": "Malware payload (Mirai)", "value": "052d97cc45b9877e7a17c25387d2d05f80ba77ae2e8b7af1bc5c4e6fe7ec6000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897617, "uuid": "03a9b214-95d5-4007-8b4a-69d103fee9e4", "comment": "Malware payload (Mirai)", "value": "017cd54d3d48ff3eba0d81754abf1f2ae159fa5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897617, "uuid": "8e139c34-34b8-4252-942c-aee4aee193bd", "comment": "Malware payload (Mirai)", "value": "2ebbba983dd30c215e89a0af77e2022ead2b5405a459690d3136bb18f87e0de400c6024dec0a3054a64cc9bedd3808de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897617, "uuid": "6232a88e-7195-4644-9c2b-f23c16cd8903", "value": "T1A623F1AEC0B871B0CAEE0DF9E8EC13FB594561CAD14E2B1ED751CCC4AE73021A5A905D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897617, "uuid": "f27042aa-4603-443c-9705-0a4847c7b83a", "value": "768:zCRVF2XSebAmdUrKmjSr4yjjK/eG65/lhCdXqU8nBTuiiSZYgaWagQB7iF0ypAVI:z4VF2fbjdISr1yWj/GXqU84iiLlL7irv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897617, "uuid": "f6745a8e-39e2-4b30-b554-d98a7d3fcb2f", "value": 46256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897617, "uuid": "2a720247-4a4a-478d-a953-e4714b44849d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897617, "uuid": "311bb2b2-6246-4677-8777-9ff712b895f6", "value": "ad7b5e127a8d132848b76e049cec89dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9aad4c-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1686922720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922720, "uuid": "3dcac070-ab0b-4bb3-a9b6-64784cadc635", "comment": "Malware payload (LummaStealer)", "value": "e62ac233d4cd945f79e4abbcbfc569de", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922720, "uuid": "5a6e2915-f6a2-48c0-a2c3-27d512b64c31", "comment": "Malware payload (LummaStealer)", "value": "0602eb69652a8376400cf879aa1b1823202ca61621da03697dbb00e3f331067c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922720, "uuid": "35fe97e9-d06c-4559-9d2d-c045a7bf0887", "comment": "Malware payload (LummaStealer)", "value": "9b584cc28429774f7afe1cee58f6bbf6d023cf8e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922720, "uuid": "613da8ac-d9fa-473f-a7f3-3e654855eab5", "comment": "Malware payload (LummaStealer)", "value": "f60bdecd5b6070002fefcf5d4a2fd79e7cc069b3ceef820918b6c771215ea2065853203212268e61e0b231acf2cd17e4", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922720, "uuid": "146341ed-f73c-4f82-a451-610305c3d2a3", "value": "T111317D042AE40B20F3B39A7284F7B251897BB859FE59DB0C018252891452721F9B6F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922720, "uuid": "7e68768e-b56b-4a15-a0c2-013184e89638", "value": "12:8eVm/3BVSXvk4RnK9hRNS5mHmW+UcZRNSzDedS+lGlfbdpYrn1IlI5u9bOVn1IlU:8N/ByKnV/+/lAySaGlTdd79ds5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922720, "uuid": "c3b1e48c-55bb-47e6-ac91-beb5fb72a831", "value": 1848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922720, "uuid": "0eea51a2-591a-410a-890c-4b67140d254a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922720, "uuid": "84b6ea82-98c5-4be4-8ac3-51cbf0f94c44", "value": "Payment.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99c15e2-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900653, "uuid": "4a84427e-9747-4ffc-a7d9-6bbe3f68817d", "comment": "Malware payload (Mirai)", "value": "02df4e8bb6a10426abef540dcdc0e0df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900653, "uuid": "d58133a3-3521-434d-bc35-913321475290", "comment": "Malware payload (Mirai)", "value": "06bc2a4e6a4a89b709fcc02939f5edaf9046d62e3a8c918c5a922fdce109cd24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900653, "uuid": "795efc41-c23d-49f7-ad46-0dc407474257", "comment": "Malware payload (Mirai)", "value": "a7d18c89615b367c48d1177cbeb9db8737347dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900653, "uuid": "b77f0554-563d-4c6b-b176-0f2698a9c609", "comment": "Malware payload (Mirai)", "value": "5a6e0d762f387c0b2a0d41b6f7e85586a62daf693a5ab0c3e01a84d8815c3e41f5cb560ccaaec2a2a937d3769b0e2479", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900653, "uuid": "a1d4c0ac-73f9-4de1-9087-2e20243f2d08", "value": "T1BA336C36E029DED0C6560134A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900653, "uuid": "13fe5f75-2db8-42ea-a0a8-eafa782d53af", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900653, "uuid": "a98394f9-95cd-4768-98a1-1fe68eb72434", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900653, "uuid": "16418286-8d91-4497-b547-a619a1af6d70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900653, "uuid": "04e5f5b5-92c9-4f03-96c1-45a437c2fdc8", "value": "02df4e8bb6a10426abef540dcdc0e0df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5212a1e8-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686922813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922813, "uuid": "8af6ad18-1921-443c-adfd-99f3ee7f7ef9", "comment": "Malware payload (RedLineStealer)", "value": "22a964e44c1dea76dfb954a02ee921c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922813, "uuid": "4ee09917-6e9b-4345-b2fc-0349557ebe02", "comment": "Malware payload (RedLineStealer)", "value": "06d9fb13b7bd5a60e364b5b0d6e880e930ceba408d0ef01c9bc6eaf7faf08789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922813, "uuid": "fdf9ac77-a013-455b-9242-181ba7f2c517", "comment": "Malware payload (RedLineStealer)", "value": "83debedb0151cb1fc3ccebd5e60d2f8f296ecb1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922813, "uuid": "7666b007-84eb-4bf1-8046-36b2e37d5c4a", "comment": "Malware payload (RedLineStealer)", "value": "3d698b697dd1e59393b9a1794c6cb2a19ca2af781d650e8b39de2d9427d9d1dd45a65ca78edf8fd112009a1f3b6b351e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922813, "uuid": "c182aac2-b6ba-4dc2-acb1-3237b3a22f5c", "value": "T19FC4AE42A17FDDA1C77F18BD88BF909F83DAEFD3913AB66E6B04A14425701115F09A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922813, "uuid": "7dfc3ab0-faa6-470e-aa91-ba7056415e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922813, "uuid": "e1048cdb-2b3d-4f33-9345-55a2b1a87544", "value": "12288:P5euljjN+pefXbGscQCPNp94hCPym0FPuTpg8BM3X:Q2B8efXbGscQCH9UCcFPyt+3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922813, "uuid": "0bff83ef-887d-4dc6-8111-ef1d6ed2f675", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922813, "uuid": "d48d64ef-cbed-48d6-9639-8afd0a3f3f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922813, "uuid": "c7515f83-22db-42ef-a359-3d691ffa652b", "value": "22a964e44c1dea76dfb954a02ee921c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff345299-0c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686906783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906783, "uuid": "8cd372de-62b5-4031-a4eb-2c5db3f7c16c", "comment": "Malware payload (AgentTesla)", "value": "0de8e78ea7a4ba0c9fcc62e221b21ff8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906783, "uuid": "938831c0-d174-4ef9-b7bc-1b03e8022638", "comment": "Malware payload (AgentTesla)", "value": "070184a649cc259d84990aff15542853838bd12e763ab54f68eb206443a3e2ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906783, "uuid": "0de400f6-4952-4cda-bf05-d94d84319341", "comment": "Malware payload (AgentTesla)", "value": "f82c11f82f652151f09e40ec74688a9cbfe2eb38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906783, "uuid": "1ac72fac-2074-4fdc-a534-309e58a72a51", "comment": "Malware payload (AgentTesla)", "value": "b458ecebe318aed060e67b5b2ab834bc5080a1c2a5547c2e6dc50e32aeff77119bad3ccfd3a108c01630aed2638f07aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906783, "uuid": "3a06e0ce-5034-4698-bd2e-75cc1b5596a0", "value": "T1AE83160173EA5A48F1F32E9E867E55644B7F7F405A39C25C166C290E0FF7E408A61BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906783, "uuid": "946dc801-092b-48a8-91bd-37abca5ed7f0", "value": "1536:44b5X/AkV+4VPJv69u6uRSqFBeWpAuhieR0R0R0R0R0R0R0RwMR4b5X/AkV+4VPA:44b5PAkV+4VBi9u6uRSqFBeWpAuUfR4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906783, "uuid": "a4db43ff-52a9-40d5-b552-4a3cc5b36c28", "value": 82098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906783, "uuid": "9cf6234f-8826-4663-86cd-17b75ab93396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906783, "uuid": "354d21de-3ce3-4066-8300-bcf80220d053", "value": "transactions made through Santander.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eaf7d6-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686914224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914224, "uuid": "4fc7df0c-1adf-43e2-acbe-aac1a880df1a", "comment": "Malware payload (RemcosRAT)", "value": "7e4ab535403f4210cb1f4f61ef726cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914224, "uuid": "15b0b331-274e-424c-93b1-1feed6da7d32", "comment": "Malware payload (RemcosRAT)", "value": "082c753b9065e2c0db0904195b91ae7b59b23d56252bf941c70cf9b0a5fcb6ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914224, "uuid": "bbd3b14f-8d9b-408d-b2d5-9a9606e07665", "comment": "Malware payload (RemcosRAT)", "value": "672c76b781156d2bacf183ecfc6527d3e9640530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914224, "uuid": "1c83e757-0a78-4cea-9ac0-82bbfa40a688", "comment": "Malware payload (RemcosRAT)", "value": "4d87eb1f17ae270d67e4ca9cf7c0765448a637a255f5c50f795f0da962d9463136007f196cdd11d023cf700130af57d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914224, "uuid": "34021917-53b4-4465-b280-0b9cab5b807c", "value": "T13A35120076A4C71BC9BF0BFA8911553183765372F563C31A0CC6B1E91E93BE2558ABAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914224, "uuid": "c189e4e0-eaf2-4cd8-8524-8e22f50ab872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914224, "uuid": "11dbed7f-1d17-4189-aae2-f7a80bb6fa28", "value": "24576:qVa1j5LA9kofN+X8lj5/d/pUb3Ek0ruaooz7o:n95LAqoNFa3lqBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914224, "uuid": "bd6fb562-eaeb-400a-a33b-23e9ac79d019", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914224, "uuid": "b4f4e3e4-f168-497d-9b11-857d580255cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914224, "uuid": "ac138192-137d-402a-898b-41f4ea9b25a3", "value": "7e4ab535403f4210cb1f4f61ef726cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a021e6-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925711, "uuid": "cad0652f-3d63-4d72-a640-f1d568fc4138", "comment": "Malware payload (Mirai)", "value": "103faf1deb705d9296f8be0641574a73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925711, "uuid": "50b2ddeb-af93-46bb-acfd-6d709f93864b", "comment": "Malware payload (Mirai)", "value": "09cb5870cc3d7136ef4a46fbe083fe000ce14501a88c42b011ed95d7105a7dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925711, "uuid": "72616638-f444-4232-a5d4-f5b37c68f91d", "comment": "Malware payload (Mirai)", "value": "9b0f403d16df0824831e420f1cb7ca143902b765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925711, "uuid": "9d2fcb3f-cdb8-4cf7-bbd8-24846e7ef23d", "comment": "Malware payload (Mirai)", "value": "71bb3fb2ab6a90468dba2ce512bd2beb310535df4d07764fdac8319627b6839ac0156209c8fbb2274a2e11eda0640198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925711, "uuid": "97daa047-369b-4941-9982-013d9c889553", "value": "T1FD638D66E6161D54C049417060EC8D393B93A5C4A2B72EBA2AE6D2B6C843F99F50DFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925711, "uuid": "495b0fc4-0b4b-40d6-a36c-7a0dd4ca1078", "value": "1536:8/dAeIcYUaS5nKisdLvAQJxcrxqGkBw1nlKaaAmwjRSCxArPwbZnN:8FmYP5FsdUQJUqd0nsajjRSzPwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925711, "uuid": "a03f57d3-87c9-4b53-b7c7-b0946739f9f4", "value": 71572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925711, "uuid": "2ff48492-8ec3-4b1a-941a-1bd4b2e775e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925711, "uuid": "6db3b617-e224-46db-8b61-b30b2dd9a7a5", "value": "103faf1deb705d9296f8be0641574a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577c2cc3-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686936995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936995, "uuid": "40b80479-8508-426e-8d40-034cf767cf86", "comment": "Malware payload (RedLineStealer)", "value": "45a233b6774a3b0c870d171353a6a2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936995, "uuid": "e83778e3-0a06-46d0-97bb-9e546bbd6c29", "comment": "Malware payload (RedLineStealer)", "value": "0a8f958b2672c2ba729f9fa15c299f31ce31a071796f0a60810db531cdf7876b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936995, "uuid": "8ad19e23-dbd4-4a16-8d2e-cf3791da9106", "comment": "Malware payload (RedLineStealer)", "value": "74e6976aa1b684491819ec031fb175659ae75405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936995, "uuid": "9af0ca79-6844-4d39-bb93-8e3dc78605c6", "comment": "Malware payload (RedLineStealer)", "value": "482523dd5872dc43213f90b33c8407383caa06af7cb70ffb59b700217f92479e80ae5e8c652f9d6df28cd773d9a6866a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936995, "uuid": "d397e626-f794-4daf-8583-22e066189171", "value": "T103A44B13A2B27C61EA368F728E2EC6E8361FF5504F5977AE92149B2F04711B2C673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936995, "uuid": "609180c3-5a15-4404-8892-96728d663130", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936995, "uuid": "dbd98157-ada0-4cf5-b700-6712ac30b465", "value": "6144:DCAmhxnLENyu63vFTp6biMHW9WfVW997ghcBz7:mxnwIV31p6bH7fEbgOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686936995, "uuid": "1d165ec2-7970-4006-8f4a-c8896441467c", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686936995, "uuid": "505fb4ba-f718-4d34-9327-d7f3d6399ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936995, "uuid": "50e6c787-cbb4-4b84-bdd3-ddd11b4489dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ca1182-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897551, "uuid": "195b3a46-6a64-46b1-a555-18cd9cbda4b0", "comment": "Malware payload (Mirai)", "value": "6c0e98473fdcc6fd0ecfd1193d2270c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897551, "uuid": "346f7f7e-0aa6-4606-88bc-3cbfe24d8716", "comment": "Malware payload (Mirai)", "value": "0b6da1bece38d50a2ec252ae58a08bb9538b1aba43b5e7e644d1a47ac3a2706b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897551, "uuid": "8e7326dc-d6e4-4f3f-8913-c057f96b0577", "comment": "Malware payload (Mirai)", "value": "92f75fe51b6f454f34bd7cb76abef79a90a1ed26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897551, "uuid": "17711c23-8168-491e-bf4e-376b0d8f8742", "comment": "Malware payload (Mirai)", "value": "b29c3e0061907dce3b1efa49495a2ffc05adf6b781afa4c1e23491f7c7edd87f7a33d124b94f049907fe18094a756076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897551, "uuid": "f341e118-95c5-4687-964c-37143bb71702", "value": "T12F2302E9AB69D105ED8DC337304F07016036E95663FA1C135AEB0A47B176209A615EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897551, "uuid": "6889e50f-78c0-4651-89d3-610a5bd8858d", "value": "768:b+adRYj4pNe9b8vdTFk8U+BzHtkz+Vr8vIvxSKePnuNw9N6Z0C+72swJail:b1dXNecdRBBySVrhJIPnuNw7g+SsIae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897551, "uuid": "15f40ceb-dbd2-421c-9c5a-f3dbf501d551", "value": 46992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897551, "uuid": "ea179430-f2f4-4bfc-8340-5c1f70e87aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897551, "uuid": "489b316d-ec19-4e04-98c8-1310a892ca8b", "value": "6c0e98473fdcc6fd0ecfd1193d2270c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82309bed-0c69-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686935779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935779, "uuid": "48409a78-c0a0-4373-afd4-86f254bd9a75", "comment": "Malware payload (Formbook)", "value": "2116c6988adf5127efda7c5b983d163f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935779, "uuid": "076a35b3-6ab3-4b5a-8bc6-65aea82b283c", "comment": "Malware payload (Formbook)", "value": "0b7841ea5b8040d0a636dfb94f374666baec80ee31307dc156c947b287d8f1cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935779, "uuid": "428f374e-392d-42c6-a2a1-3a582a6dcd52", "comment": "Malware payload (Formbook)", "value": "8e5e2b6aefed9bb6d90f185feea18cd962ce5049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935779, "uuid": "7c4da3c5-6607-424b-81b9-44c59906063f", "comment": "Malware payload (Formbook)", "value": "fb37ea083c1dcfbab24773d4470f3c3428726d95eb287677698c061e53e723341934b320543b68ca24c7861dd3782533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935779, "uuid": "a21d0a52-654c-4bb9-80e4-8ef4123b5583", "value": "T1FD05D080723A2A27EA7E8BF5025062B097F12F5FA15DE6D84CC670DB96F5F810641E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935779, "uuid": "8cccc9ae-8517-4b95-922e-7562ecb83cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935779, "uuid": "816ec66a-2486-435c-8a50-efc6a47e0984", "value": "12288:klKnuTEXqXdVEzLHHYsoRuEyfW5rcfr0iVyoF1o/YPZqEJzIHDnaK:xq4qXdVUeRDr8r0VoTMYsR7aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686935779, "uuid": "18c61108-d3bf-4694-acc5-80b1c11470d7", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686935779, "uuid": "675b05b0-1de5-4e23-94a0-b78116d7413a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935779, "uuid": "83a8fc4b-03c4-4821-ac7c-2912f6f99634", "value": "po1261Template of Invoice packing list3-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febe3f63-0c6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686936417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936417, "uuid": "42c3447b-b2a1-4de5-a8b2-43f7600c8d67", "comment": "Malware payload (AgentTesla)", "value": "d8ade49e4d3a6fa7390c1c31ac85d204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936417, "uuid": "38c0db12-4b97-4532-8c89-cd415ed63c49", "comment": "Malware payload (AgentTesla)", "value": "0c3959bb80d9187387e3b41f8ac1aed632548614454e0888f8fea7404eed8304", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936417, "uuid": "49ecbbde-a8e3-49fb-b690-7a27750d93d4", "comment": "Malware payload (AgentTesla)", "value": "7a9cec7174a08ea57e0cbcd11fa05bc6ceb23793", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936417, "uuid": "faee3bbb-875c-4b87-b740-8f01d7c2155c", "comment": "Malware payload (AgentTesla)", "value": "fa4057118f9a57b177edeb8e2bd1b3bed307593ea61feeceb3326dec6937c674820bd65298edad4fb7d9ba6971f867fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936417, "uuid": "39abcf77-42fc-47a7-850a-eb2cd20f8074", "value": "T1E3D42398D356EB23E0BB0BF90A64677443FEC6A1F82BD6A70DD7B1C89211F510650E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936417, "uuid": "529a09c7-fc52-41ab-b624-dceb838f40e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936417, "uuid": "e60a5ba7-f946-44f7-bc8c-bfdf43352166", "value": "12288:95LbzIu9+r9py3OUgYr5wzKCuF2oChFtRnRhCNEsV2ndqEq+55or:95LA9GTr5v7ShFtRnRYGi2dqEq+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686936417, "uuid": "f8d069f0-4b44-40bb-9561-d8f1ee3ff380", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686936417, "uuid": "99183b13-bdf2-4cb7-b491-33c3651b18d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936417, "uuid": "973e4e41-4ecf-4e7d-a41b-92cfbad1a524", "value": "SecuriteInfo.com.Trojan.Siggen20.63718.1489.13613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2157f90f-0c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686897820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897820, "uuid": "10054b7f-0f69-42bc-a19f-e7eff6884032", "comment": "Malware payload (AgentTesla)", "value": "cf593c55803df0de743ae3e2a584ea57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897820, "uuid": "da0e8846-c716-4799-832f-515ef7016126", "comment": "Malware payload (AgentTesla)", "value": "0d60b66a4cf05690e7a7afa8a54328fd3b043bb5a77c9c45d59ecdbc8f7af440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897820, "uuid": "34c462e6-04fc-46ca-bb66-24f1dc05b89d", "comment": "Malware payload (AgentTesla)", "value": "cc0e881b11216268fc3447685ea5afe0ac030c2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897820, "uuid": "8c971101-56cf-4662-b44b-7d03052a96a9", "comment": "Malware payload (AgentTesla)", "value": "db7770cd4bc38387f44a2f3f8add2a3b8ddb0596a1ff782260845b3e91c707115f3a48bc658caed5713b4d35348d3ed2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897820, "uuid": "9ba6f6d0-28c4-4223-b460-a4df220380c7", "value": "T10015B5B8258026ABD7B5DE7681E1094BF13F3717B2639D5822D213C5862250FB7ECA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897820, "uuid": "897cbcd1-510c-44d3-b49a-8a4e72aadca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897820, "uuid": "133a0d4e-ad5c-4c94-b030-f2250813b8e4", "value": "12288:yb3LsgLV0fj8CjTG/Ulm7a9OfEUSm/Cz9jObtljPDms8g:ynVqACjTlMhb/Gj42g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897820, "uuid": "37ac0f1b-2224-4795-b6fa-040f0df5395b", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897820, "uuid": "6d6051a8-bf36-435a-9c60-6bdcb7766cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897820, "uuid": "3b0542ef-8c7c-41f9-b2b1-dac1efd3476f", "value": "1092991(JB#082).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7ba827-0be6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686879616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879616, "uuid": "d60f4a53-8b44-47e3-8fdc-017194fa85ea", "comment": "Malware payload (RedLineStealer)", "value": "38e3ee2402f504d7b662f83d6898e33d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879616, "uuid": "2212dcc3-31bb-4805-9fbe-6dcd64c10f55", "comment": "Malware payload (RedLineStealer)", "value": "0d8247c4ed6a49e33ac5d481f08cdef22d2ed7caf2434d031e0a0cebe296893d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879616, "uuid": "239e42fe-3276-4000-a392-f2ecc8031fab", "comment": "Malware payload (RedLineStealer)", "value": "681eff87d31fa28c9456a76f35719cf96f2c276d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879616, "uuid": "d8369ede-9b8d-47ab-b49e-efa358b86ba3", "comment": "Malware payload (RedLineStealer)", "value": "e0c26fd10ec9cd21ede5e6765e6907da884983ad34d60a042be7a501f56cab1b00be4c849de8b77dac941cedbf756d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879616, "uuid": "712851b3-813a-4cb7-90cd-1c4b074bfbca", "value": "T1DAF4020466D88B2AC47F0BF995001231837A6327F537D7170DC3B5EA6A92BD2915BB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879616, "uuid": "de04f858-f8d0-4adb-87eb-5aa92ba52b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879616, "uuid": "60d771d5-50b0-4337-b839-4346ab280fef", "value": "12288:pNPwZa2iNx5LbzIu9+r90pHJNqukj4defl17qVmnnY7fLb5FIevjrGU2k4:3Qa1j5LA9GH/qHj4I1WKY736UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686879616, "uuid": "b87eff2c-6b58-4eb8-b559-32d06dcb0720", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686879616, "uuid": "698d36e5-f116-4ab2-80c3-f396f6716c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879616, "uuid": "847d21fd-a034-49b2-9ebe-d6af5575807b", "value": "SOA Sinotech Logistics May'2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4a3a70-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900251, "uuid": "090625ba-fe55-4531-9ea6-ddb41e705b3e", "comment": "Malware payload (Mirai)", "value": "0b3b4c1c67e5dd3aa20c71c14f72963c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900251, "uuid": "75004b68-a850-414f-b7d1-61b9b0130777", "comment": "Malware payload (Mirai)", "value": "0e4c98dcad06a3e60b87e2fb1fddc037b77b9669df3c82711527e00cb5af7f6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900251, "uuid": "890083f4-afcd-4575-a8c8-93d4a606b2fb", "comment": "Malware payload (Mirai)", "value": "a2131e542fe82f7f9c340c2c1ba401601ab750b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900251, "uuid": "b8221bce-d784-4a4d-891a-e29fcbf8c9b8", "comment": "Malware payload (Mirai)", "value": "a8b602228e917a182338cee7aa66975aeafda4daaaf8ce107e980385e2d654ef3f9ca57ff7f7bdc91176e641de234838", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900251, "uuid": "03267dbb-f8b0-48f1-b966-304a6fb59807", "value": "T1B1934B9AF4009DBDF80BDB7A4017490AB53062904BA30F37A3A7BDA7EC771956C17E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900251, "uuid": "4e379696-1dc2-4765-a847-5ce48390706a", "value": "1536:GSeW3kCFKLP4+628LyO4/O2HXX2vL/rvBr8dUnDH3fgAUwAE73bXFLofbmOBeTBL:GHpAvJWO4/O23mvDrvB9nEADA6JmbZed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900251, "uuid": "32cfac1e-8d0d-4b01-9644-73bec1b680a8", "value": 96792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900251, "uuid": "10c403d9-c83e-4b98-99a3-add6fff2a74c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900251, "uuid": "b9cf0515-a47b-4e49-bbcb-4eb3e447c1b5", "value": "0b3b4c1c67e5dd3aa20c71c14f72963c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ab6520-0c36-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686913818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913818, "uuid": "440a4423-e57c-42f6-b35c-7774d31b9573", "comment": "Malware payload (RedLineStealer)", "value": "1eca29167a1935e6b9dcb1aacbf4c326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913818, "uuid": "f71d47bc-ef98-4c51-825c-a725c5ccfa35", "comment": "Malware payload (RedLineStealer)", "value": "0ee8ba84091143fa96f4f092b33bac01d491f0b29a48a24b0d10dd7013abbc35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913818, "uuid": "33e8d605-88e9-470d-ad4f-e7e392a4c7bc", "comment": "Malware payload (RedLineStealer)", "value": "0eea8981ed692f3f9cd1eefeca7df79a7096b3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913818, "uuid": "5be58225-e99f-40ba-b936-8c39b889a46d", "comment": "Malware payload (RedLineStealer)", "value": "9f966ede54fedcd3361f85536092e9fbdeaf93a6747bdb4cbf20514facb0445f4de5b7771c8bc416459ec6bb52635e06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913818, "uuid": "480d9b42-3939-4af4-b44f-2a5c74645339", "value": "T1F424BF0376E05137E8419CB294A9A67D2DEBB6B83EC5D0F73214312DAE523E47A31739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913818, "uuid": "bb8e3106-a63d-4ff9-b7c2-00b2a9f8f100", "value": "72acaf8dcee1b47852a7b85487e3884f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913818, "uuid": "235ef951-bd41-44e7-ad0e-02cd40feab4b", "value": "3072:eUWh2pd0NK2aiMUQysi5dUtcxc1mvv6Q2yKYjubguLpsQAxe:NcPaDu2FQxKVzLpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913818, "uuid": "65f195d5-b24b-4728-860e-2267a88c6827", "value": 228472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913818, "uuid": "870426ad-33e4-496b-a802-416c74a804f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913818, "uuid": "8b44e273-7509-4699-9f10-c16fdd896eda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358cadd2-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686914175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914175, "uuid": "dc33578f-437b-4844-aa1b-01d7aa15a0c2", "comment": "Malware payload (RemcosRAT)", "value": "ea1c2e6050904048e75d5335d873455a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914175, "uuid": "80aeae8e-76d1-4bde-b688-7abc7ac1aff3", "comment": "Malware payload (RemcosRAT)", "value": "0f611b87697a816d5b37f745fa94c89315327ba3458c190fe41efd891ccd5196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914175, "uuid": "14a9e8bc-9651-43cd-b2bb-da9672845fc6", "comment": "Malware payload (RemcosRAT)", "value": "b9a6b7f8af3a4e05e49ae1be1b211d6fd10793cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914175, "uuid": "33e76a1a-9cc2-4a91-ba9c-b44441e4f421", "comment": "Malware payload (RemcosRAT)", "value": "47a89b9cd82e144c99cb95444037644d3df0653278036a72811241070d353f07c451d56afcc4586862569b69613fefec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914175, "uuid": "f005534f-5f34-4c68-9434-fd5d4e59b120", "value": "T1A6A4F198779132CFC81BC876C8851C6497A675A7133BD387A94702ED8E1C6CBCF497A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914175, "uuid": "cdf2022a-a16e-4bf9-8255-304478c2cdf6", "value": "12288:9WI9Zb5rh00yAeWJDXcjpC16nTZUgUt48egx:9W2ZYc2ltHIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914175, "uuid": "365d8877-8ae0-4fd5-84aa-b75a9b267206", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914175, "uuid": "a4917280-4925-49df-b7d5-e3391a166adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914175, "uuid": "310dbcee-937b-48b2-ad74-01f00eaa422f", "value": "ea1c2e6050904048e75d5335d873455a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61d085c-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686913612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913612, "uuid": "96df35b4-04b3-4f17-ab76-2282fd557af0", "comment": "Malware payload (AgentTesla)", "value": "bccf9d054fe7f086c37c1199a6f8ea15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913612, "uuid": "f76c8691-940c-4685-a45d-8d071d3b5007", "comment": "Malware payload (AgentTesla)", "value": "0ffb2f62c79661847214dbf0242b3ccb488782b9a06278a1b66244f9338f2525", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913612, "uuid": "550708a7-212f-4426-b81b-82c5857f927f", "comment": "Malware payload (AgentTesla)", "value": "c4983b605197e98b007da7b73d24a7f6ca0c159c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913612, "uuid": "0bbddbda-37e1-4698-bbac-88c0344d0b0e", "comment": "Malware payload (AgentTesla)", "value": "4a7c8292db5dee0bcaa249f311b85f48a7bf93671c28e2dc7b62e721799e6073d1d194bc8500d039c6fec326a568e287", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913612, "uuid": "9af16afd-ad1d-4d72-8763-f0827a80fa65", "value": "T17FD4239C96E75713C07B5BB698381D78033E66EA7C27E2360DC7B5CE1A90F112A61D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913612, "uuid": "31eb6069-b641-4c6b-bbb4-e3ada019e577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913612, "uuid": "3ea37e1a-5a85-4729-99e7-c78a306c6314", "value": "12288:q5LbzIu9+r9hwVtNbfFOyvPZRaWVqNW2ne+F0Jki83JKUngCslw:q5LA9hwVXrFTHZnVqNfF0JkSU7sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913612, "uuid": "ca189ebd-7caa-40d4-b922-69cdf21aecf1", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913612, "uuid": "9638d15f-b1f1-4b80-85ab-9256a9a7a798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913612, "uuid": "295aa5ab-a9ae-4a08-b072-037eacd6a808", "value": "SOA 701429859122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31ef793-0c57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686928210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928210, "uuid": "aa862113-f176-455f-8613-88d5ed86908e", "comment": "Malware payload (Loki)", "value": "dd81531dc82ea04dcfd5b6d6fc61dfd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928210, "uuid": "4f85f5af-323d-4de2-bf9c-1cd4a5e783e6", "comment": "Malware payload (Loki)", "value": "10018c42effd32f85253fccf9e6de9e7afc97a7a9369af5ebc6bee351fb52e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928210, "uuid": "9469769b-1bf4-4a84-baf3-bc82534986ba", "comment": "Malware payload (Loki)", "value": "dccbda4905ecf0f774d5de8eb02a623d5196ac55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928210, "uuid": "f27d70e8-9a2f-4a0e-89d3-e608fc995c32", "comment": "Malware payload (Loki)", "value": "8a589f7135d9e0b604b33793dec6d192766a8104443e03539363265aa37a6cf69fd106464508d3fa5e93658172428659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928210, "uuid": "9e5ce3bd-c7a0-4f44-a358-08817dbbf769", "value": "T107E402983BFA450BD65B3FBD192055B0CAF9AD867523D34F4E8B789DCCA0F414A80563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928210, "uuid": "92ee42a5-11fc-4332-900b-6b6880114c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928210, "uuid": "ef4b6295-9bfe-490c-bb64-a32366a2f3c9", "value": "12288:wuZas/16/YHmM9mARLAV+/3nRQOmunniwnZz7TpIR5VVfgJibL:wVs6cV9mA9Im6Omu9/6RXVf2iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686928210, "uuid": "a3c837a5-421d-4347-a11f-3037d232356e", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686928210, "uuid": "07d353a0-48bb-410f-8866-48954c824dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928210, "uuid": "60077c94-6f0b-4498-bd95-11d02105677a", "value": "rFt8szNIaFjhkY4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2bddd9-0c6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686937673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937673, "uuid": "e90630f1-854d-45ae-8deb-4825a63381e8", "comment": "Malware payload (RedLineStealer)", "value": "b0037d26e1128bb225a34a6c00eeefe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937673, "uuid": "45dc4dac-9353-472e-b262-5f4f6f7958cb", "comment": "Malware payload (RedLineStealer)", "value": "1107924f1ace30ed819e1c694e406da31f31ff9250e750011450050e1147eae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937673, "uuid": "0af02bd0-a350-495c-aec9-102d19d88d17", "comment": "Malware payload (RedLineStealer)", "value": "b2caeebe0d4a819e1ac3024fcc69b85c5276cbc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937673, "uuid": "b41ed2ed-9095-41d8-a59e-5d5cabe366b3", "comment": "Malware payload (RedLineStealer)", "value": "f63a86e02ccf478285e8458d7333de2d1f95c010eb69625cb2def159ba9928a17f644e2abb40485ab97072998b78b0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937673, "uuid": "766be77c-d371-49d7-8f0f-7e16ef4e4419", "value": "T1ECA44C03A2E27C55E5758F72CE2EC6E8361FF5904E1977AE92189B2F04B11B2C5B3721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937673, "uuid": "b0f7cf41-efbe-470e-a786-f7dde810a361", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937673, "uuid": "b15f858d-dc3b-4a5d-85f0-b32b3a2fdd4a", "value": "6144:XBoUHz5hivVFNxt5t+w5eAvvHU4sIBkB7xl9:KUHz5hAJvzsI+1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937673, "uuid": "8bbe3b35-5167-4374-bbcf-0fee9324a497", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937673, "uuid": "7b7e96f8-1391-4363-87bc-8f06192c6ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937673, "uuid": "d48f7378-71aa-47ad-b55f-a5bb80333d3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4395a52a-0c5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686929661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929661, "uuid": "f5af0f3b-e756-4662-837d-e48bab787544", "comment": "Malware payload (njrat)", "value": "bdbba5d19f83f7da785110c07122cc48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929661, "uuid": "524c8422-1949-4f5a-bdef-897c77df7e59", "comment": "Malware payload (njrat)", "value": "114784f1f94b09a3ee0621eb19120e81f61219dd79fcc176afc3dd40da0782d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929661, "uuid": "ffa904bc-b897-441f-90f5-cf353fbba650", "comment": "Malware payload (njrat)", "value": "33bfb0d40eef210aeac9ad67de84bb067186e089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929661, "uuid": "e0d8951a-94e7-4c44-9280-3c480796032e", "comment": "Malware payload (njrat)", "value": "08c2f6838ec51e85e779c710735c3a5f55d682b333236c82e91123b3419175d4682bca0746ae18b5d4aa1338840c6210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929661, "uuid": "2a223aaf-f789-4bc2-971c-511d84bddc92", "value": "T1C5E208067BE94215D6BC1AFC8CB313214772E3438532EB6F5CDC88CA4B676D00255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929661, "uuid": "7325e2f1-e46d-475f-b9b8-380197990747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929661, "uuid": "a84ce7cd-4da3-4c7d-873e-645d23cebb24", "value": "384:D0bUe5XB4e0X+Od/w0Q0mS03AWTxtTUFQqzFiObbZ:QT9Budi55dEbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929661, "uuid": "061ac01a-c5d6-4adf-9ed1-d82d1fb86a6c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929661, "uuid": "dc24789c-006b-4e16-88de-43ea941dbfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929661, "uuid": "3aa513fd-3c19-4cb2-aed9-bc869115dc20", "value": "xFolDr6agOnc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef29a5b5-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686876691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876691, "uuid": "43a9999f-7a8b-4d38-8ceb-166f59d3321e", "comment": "Malware payload (Stop)", "value": "71a4d1e8fa919ca998fb1d4ac6f24203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876691, "uuid": "afb88e44-e2e1-4e9e-90fc-e48cb2b71769", "comment": "Malware payload (Stop)", "value": "121bf9686eb68b5b893c03497f0afdaf03b9ee149e0cb4eb9232dad12d98f235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876691, "uuid": "b6d618f0-0c71-462a-9241-55ed3c5af755", "comment": "Malware payload (Stop)", "value": "12ee7839d283db10c73b952272ccf00ad3466ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876691, "uuid": "285f3089-a4ce-4954-b958-167fba296b84", "comment": "Malware payload (Stop)", "value": "128c49975d58d439a390662b20966a0edf37ffd9465e772d77b0b86d0ec9fb9a2d59f088bb9b5cbf4402c6d709d9ccdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876691, "uuid": "3e090e3a-daa5-4646-855f-ef48b9b5bad7", "value": "T1E3F41213FEE0A872D565D6734D6AC6A1BB0CBC60EF48679B222C7A1F0A711D1C671336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876691, "uuid": "e09cb2ca-baad-4a5b-b04c-5d6e4c2c543f", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876691, "uuid": "362a13a4-3a4b-4170-96b7-852c6f5132c6", "value": "12288:79EbSOCYc7W+A5a0qn3TdmsjqH4TotnkYoSLkg6J2/IcjP7Log38sMrwjweKPq:79jgc7S5a0C3TdmsjqHdyYoyH6Q/RPvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876691, "uuid": "f15df1fc-0250-4e93-976d-428c52692016", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876691, "uuid": "76a63a97-0f4e-4e6d-8070-bd6757838fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876691, "uuid": "897bf7c5-bfe0-4e87-abbf-0557d65bccc8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6cc3de-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686894408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894408, "uuid": "03926127-8ca1-4a36-9dbe-985287b645fc", "comment": "Malware payload (AgentTesla)", "value": "1152b50293e1a9f4b422ab530a81559f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894408, "uuid": "48fff15d-d24f-436d-b8c0-8e8d63fa95e6", "comment": "Malware payload (AgentTesla)", "value": "12384caecb7a336ae37a29e642488b5cc45559c321dad21c4c8fa7868a2ce859", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894408, "uuid": "3dfeee97-d411-4bec-801a-1c933348e7eb", "comment": "Malware payload (AgentTesla)", "value": "26cbda68a51fe365ea08c49d31eb6b4cfabac6d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894408, "uuid": "ee617227-3805-4f53-9502-9a315ff914f6", "comment": "Malware payload (AgentTesla)", "value": "90327c24179cf92a31ca6b957a74307edc61e1a040c792942240c3940bbaadf897d10cada555154e3ec3935ec5c71fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894408, "uuid": "f739b949-239f-42ee-b695-c4ff38d56a17", "value": "T1B405121023958B1AC07F0BFA45142131877A6376F673D71B0CC3B5FA5E62BD3516AA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894408, "uuid": "a2f5cb62-5e73-4398-bf01-524b984d4a1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894408, "uuid": "8f6d0532-5d6b-4ff3-a0c7-dada176a24a7", "value": "12288:kN5Ga2iNx5LbzIu9+r9A3ozlfPC9Oxc+p+9wDq22XuP48cz2Ztgr:La1j5LA9A3AlfKAxo9oVTP4zzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894408, "uuid": "6f824c61-a0e6-41db-8ea4-6daeeff1568a", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894408, "uuid": "74020367-d960-4dcd-9b82-5e6732b4956a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894408, "uuid": "e5837e3b-0e0f-49e9-859c-a5f50ec33775", "value": "EPPCO Inquiry #18300231606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac7c75-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908929, "uuid": "616a0f28-d920-45ad-9298-2bebfb3369a9", "comment": "Malware payload (Gafgyt)", "value": "5b3b04a2cc3aa4b52da5d84a94e7d8dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908929, "uuid": "e429b70e-ce1e-48c4-83a2-90d637a46602", "comment": "Malware payload (Gafgyt)", "value": "137466475138a8d9480e291ed8e494f4683dc5a185af003f8fa6dc65c24904fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908929, "uuid": "bb6a394c-23c8-4a08-ab2d-72c6527f13ec", "comment": "Malware payload (Gafgyt)", "value": "e69e61e30b24b0691b13c3c733a5109a653a02ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908929, "uuid": "74caf8cc-1788-48e4-8120-550aadaeb6ce", "comment": "Malware payload (Gafgyt)", "value": "688f80d1c826cb2b2fa7d27bc85faa54b9ed31faa2e4d400e3da0b041c5ce1302edec1b4fdcc1475f47a9a56904c73af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908929, "uuid": "e00ccb1e-1137-4c6d-aae6-4d6ea64d0cfe", "value": "T154B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908929, "uuid": "05de7224-1400-41d5-8e71-87b899415b9c", "value": "3072:WD3l+XQzPeV91310pWud+KakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWC+ypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908929, "uuid": "78e3ee8b-ca16-4808-95ec-a6a3f09cec73", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908929, "uuid": "3b5264c0-1316-4bf5-9b0b-5f0ec57c248c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908929, "uuid": "6d11e8a8-b8f0-45fa-b7b6-003b3ab7d23d", "value": "5b3b04a2cc3aa4b52da5d84a94e7d8dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9eded02-0c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686893003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893003, "uuid": "d14dce7d-dd93-4440-b712-632ddaba6a9a", "comment": "Malware payload (RedLineStealer)", "value": "7fb34734c750ee2f0025202a4082ea21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893003, "uuid": "b4cba2a2-898f-4f93-84f8-b1bb25c50bfa", "comment": "Malware payload (RedLineStealer)", "value": "13d03e8abe8c360196bf04e41e99da11292d08b126b47432a2c92ed2906b97cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893003, "uuid": "d07810a8-401a-46dc-8aee-d7e5c127c91d", "comment": "Malware payload (RedLineStealer)", "value": "3f5851300163dc4e451e710d5d81b864ea120221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893003, "uuid": "04f7173e-de04-43a1-9136-2d49fc29b604", "comment": "Malware payload (RedLineStealer)", "value": "d12f8f6146cfb0eb64355987074429ededfb5fa528293d0eef999ca769399a895b25fdf7b06a214068d2d5ecc04054e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893003, "uuid": "31f7d301-7bc6-49cb-a2d5-7fbc3c5414d4", "value": "T126A44B23A3E17D50EA669B328F1FD6EC761FF250CE497769221A9B1F05B12B2C163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893003, "uuid": "f6bf9442-92aa-4769-9f3c-97607434f737", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893003, "uuid": "657e1fe0-7377-4418-b50c-82b570429bff", "value": "6144:JA01CemuwT7jccSSg6VSFg8WOwFcfAMM4YetEeg:NoFrzgF+8WOwFcfDBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686893003, "uuid": "b0be3cef-c4ce-4075-b514-3b3ba082188e", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686893003, "uuid": "4cc30675-3baa-421b-85b8-769b88da6c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893003, "uuid": "331b6ebb-b07d-4734-ab14-db71e52b1e34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f85e1d-0c8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686950040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686950040, "uuid": "a954a4f2-a3bc-4327-8bac-6492d52bd64f", "comment": "Malware payload", "value": "4ce78b41df3f0bb4dff20793bcc9f78d", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686950040, "uuid": "82aa1c27-7302-4dc5-b774-a4badcfbad39", "comment": "Malware payload", "value": "13e9be0aba1cef3943954d2a204472356721075f8ecbfe565a476aec8346fdc6", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686950040, "uuid": "e03ea92d-4ad5-4a66-ab69-c89b58a7a596", "comment": "Malware payload", "value": "4de22b09a356224b9916836ba2ee181d369d5f4f", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686950040, "uuid": "ecda7042-f2f1-4712-a683-114ba54b6319", "comment": "Malware payload", "value": "5d56e82bce758a00d4bcc14201cf6509f492ad731f08f3e2e384b19fb3744958b25fa8522b4cfb94c9d8bb5df861d366", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686950040, "uuid": "ba5c623e-b707-4c5c-af3a-88f040b9f665", "value": "T162734C9EDF806A37FB4C7A7B84E109C44BAE659DD760E07331C5E93E4E27608C156CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686950040, "uuid": "188042f2-a76d-4f6d-b62f-ab049d836099", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686950040, "uuid": "652c0ab1-d484-403d-92e4-903f391dce10", "value": "1536:FQs9dlD27v+ielYRQvA8eZBqmW5vSx/KDrgfIDW0I+U:F/D27WLYRmA8eZBZW5vSRK5i0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686950040, "uuid": "93c90793-16e2-4372-b5d6-a5ea648b9e4c", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686950040, "uuid": "b987d32f-8f0a-4da5-a350-dc17923801a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686950040, "uuid": "41420171-04d0-4e7a-abda-2d47c40c0a5c", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9055bf1b-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914327, "uuid": "0a6eee4f-e15e-4328-a6e2-008e022a33f7", "comment": "Malware payload (AgentTesla)", "value": "f5ed6d70b2c05c5b9beb673c250df3a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914327, "uuid": "8078659f-6229-41e7-b57c-c3e99c11ebbf", "comment": "Malware payload (AgentTesla)", "value": "14480f4ce9a1c99ea2336e2d28ccd37aac77275f8adde88ef001318b45a644b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914327, "uuid": "fac100b4-c99e-4962-b455-c033239c029c", "comment": "Malware payload (AgentTesla)", "value": "3371c16c53377acce7865d1373ddbe6f37476a0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914327, "uuid": "90618b8e-06bc-4527-bc59-b6ad5d142261", "comment": "Malware payload (AgentTesla)", "value": "b60bbbd2a84a233d695f69e69da999632ee8feaea674f79148cc443050a9fa441225a3d7f87170c259f50e6b376ff9dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914327, "uuid": "6fcd00a7-cb3a-4394-a94b-1d8589fd936c", "value": "T18015E023F5CDE7C9E09E06789D24F7BE22226D615431CD6B2C96F1886934B0625F387E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914327, "uuid": "0141177b-b90c-480b-935c-0fab7feedd1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914327, "uuid": "ed1bf882-2456-4550-a84a-09c7c574ee41", "value": "12288:r5LbzIu9+r9N6VCIbtDN9u22xrSuO9RlhigU:r5LA9xMYL0P9rh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914327, "uuid": "700b8c9f-c616-435d-920a-657eb53d6c82", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914327, "uuid": "ef378eb8-bcbc-4296-a7d5-fdadbb2cd203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914327, "uuid": "9ffcefd2-9f3d-4a9e-bb27-dfae96de63ec", "value": "Halkbank_Ekstre_20230614_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59529917-0c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686917671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917671, "uuid": "a2fe28d5-7b48-4067-b20a-024a35db633a", "comment": "Malware payload (Formbook)", "value": "41ecbb619f42964e00ae364736a171af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917671, "uuid": "11052f23-5ada-4028-b16d-f04c060537d6", "comment": "Malware payload (Formbook)", "value": "14bd08ddfd5f3fbeffbe9adacf4662f83267492eb8a2ca70a5c7613050039dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917671, "uuid": "3c334014-7535-487d-a530-b97832dba6c5", "comment": "Malware payload (Formbook)", "value": "9027cd25d6269552c2156f72cb9b0de95906d754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917671, "uuid": "4b4844a0-db44-4574-9895-79956d4d6378", "comment": "Malware payload (Formbook)", "value": "6d92f5392dc0ed26b7b5c3dbcbbd37471ccbcb07536f9156e8f67dbe16ce0387673b30c01d9bbebc20f44b0fb8637b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917671, "uuid": "dfc09345-d15b-4ebf-9dfd-0af9ce583000", "value": "T14C05F10DB7AA784FC9352AFD48059939A7FC6D522562E7C34EC778DAACE0FD11891083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917671, "uuid": "286665c3-c6a3-4e7d-990a-ca0f9f33663a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917671, "uuid": "61539efc-fc81-4d2d-b766-6babf9021cae", "value": "12288:EWH52iNoOe42KMu/N3mWhQmwmJCMpUYx8PyXN6gPwANi7q4A26XT5g0eHbNkrQno:11mOV/NOa/YTrJAJT5g/dnCmUn8O8pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686917671, "uuid": "4c0cc6c8-fcc8-42bb-a504-d0859037d104", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686917671, "uuid": "608f2430-dadd-4c46-835f-fdde855672ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917671, "uuid": "d47d359a-01ca-4765-93b8-5bd8d48c8cec", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dba42bb-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686905975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905975, "uuid": "6759fad9-a31d-4f84-a3f1-834c70c65f48", "comment": "Malware payload (Mirai)", "value": "c89a6ca3ac648e41a8a5188894fc9c45", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905975, "uuid": "db2f1f17-6f70-474c-92d6-1f145e825cd7", "comment": "Malware payload (Mirai)", "value": "164e0138b4cd2c0860063d9e56a73b56b0114e2519e5251f4cade4dde0dbede8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905975, "uuid": "40e06ed4-ac65-40ae-a768-8d0a4bdc8851", "comment": "Malware payload (Mirai)", "value": "230871dc39b70973a106eef32c411250a99413aa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905975, "uuid": "8b9a3855-ec76-4255-90dc-008b23240286", "comment": "Malware payload (Mirai)", "value": "eba0f30d34fd1d998d0ea0f888d0ba071aa038acee4737ce37469d12d47314ef69b44bcb943f53d6aed60b61d22970b6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905975, "uuid": "9c4197ab-bb70-464d-8abd-3acec97c1751", "value": "T10FF2E16AB377F97CE9B5C072380A15C4F6396805991DCBF708E876A998D77042B213F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905975, "uuid": "b4299683-5569-4bb5-a4d6-c3e6dcf2c48b", "value": "768:6dXCmnqzSqOeFG4e5OiisV50WgRJyM145vyz9Sv9sPCE:oS2qGsG4eIM0WY0vy8FuCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905975, "uuid": "6d179d23-ce40-4a7b-9553-810dda742df9", "value": 37372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905975, "uuid": "e66a8f8e-0a84-4f3e-b128-997bb2c11b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905975, "uuid": "e541ecb9-fd7a-4137-831e-78ef427abfc3", "value": "c89a6ca3ac648e41a8a5188894fc9c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadc2075-0c5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686930398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930398, "uuid": "99c830ff-d200-4217-ad41-d2be8e3cdf6c", "comment": "Malware payload (AgentTesla)", "value": "b58f92af2dfcb2b3a68725af2bf950e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930398, "uuid": "1f7be6eb-1280-4894-85f7-415e3e19cf32", "comment": "Malware payload (AgentTesla)", "value": "169c4a3f668ce8d737dd54f1ab2a920badc42832968e7987eb660319eb938259", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930398, "uuid": "a7b20141-0b43-4c87-a4de-26bb85e68afe", "comment": "Malware payload (AgentTesla)", "value": "2a69c0a289d4f41d8ab2ed3b3ff9bb16e4cd2f6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930398, "uuid": "0b916756-a1d6-490a-aa8d-a170ee90b64d", "comment": "Malware payload (AgentTesla)", "value": "46835417a80c9ba99b47e6128dd1c73f5e4b3a0a3a2babd2ce41e15ee358e3c9fea166212de7df3d326252f715c1eed7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930398, "uuid": "a3e5689b-6a3b-4f14-b865-94cc002fdae0", "value": "T14FF4124453ED8B5AD9BB27F8A52580304BB3B45A7536E75E1D42F0EA2A32F204F02F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930398, "uuid": "65dbfea1-8c39-4709-90eb-9916799b9267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930398, "uuid": "a9085ac9-de4a-4fb0-951a-85705577b765", "value": "24576:mqOufrq7x/7Tjd7Adn/HowKExFb0rb6usC+4qXdVJ:hFfCRlEVvowKELgZsC+4qXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686930398, "uuid": "8b850709-987f-4b9f-965c-cf75b043c14f", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686930398, "uuid": "f109c372-aa1d-4169-b678-013bf924c8b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930398, "uuid": "d1881fae-2b30-49dc-a007-dd435db80c6e", "value": "bill slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9b7cce-0c5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686931607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931607, "uuid": "e918b376-8122-45ce-a7b7-c1621589e744", "comment": "Malware payload (AgentTesla)", "value": "773a357c88815b9c279f44a78f4fa18c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931607, "uuid": "b3e3bf64-0d56-4271-8ff9-dd2e8a64c372", "comment": "Malware payload (AgentTesla)", "value": "172100832947be8421d9001eeb61253c61fcfcd0922623dffd15a2fae3ff9625", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931607, "uuid": "6f250463-d8ee-45de-9df2-028c2dcb1513", "comment": "Malware payload (AgentTesla)", "value": "4cfbdf0f5124655a75aa78e2708ff3a67f9bf236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931607, "uuid": "9c0899ec-133a-432e-80e9-f7a80214e58c", "comment": "Malware payload (AgentTesla)", "value": "e92fd8cc0c2ff7e3325bec058b970386f2d69a77ff2c31bce9b9056f08006d544006a0b9700036667f5bde903705438e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931607, "uuid": "c2e70f46-5a74-48df-bb87-e87a626657e7", "value": "T18205011497AD8706C9FF23F5947055304BF3F96A743AE31E1E82B4EA5A62B214E02F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931607, "uuid": "2a64a88f-7cde-46c4-b046-286eae427797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931607, "uuid": "a5798812-4ebc-4bb2-947b-8197788c3161", "value": "24576:KHzJx2uyirk+bWnErNrkQsbRV34qXdVxO/Rb:KHz32uyiw/qNfSV34qXFaRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686931607, "uuid": "d0507bc8-b7f6-46e2-9a5a-2317ea5d56fb", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686931607, "uuid": "b24d7eb9-b33a-40e3-9483-f1644fe9eeb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931607, "uuid": "8929c30d-630e-4f8e-ac0e-ec4aeb8e4dc2", "value": "NEW PO #7201982736_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8490d5fd-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897557, "uuid": "e93b54f9-abd7-41a8-9f61-7cabcd880b82", "comment": "Malware payload (Mirai)", "value": "dd23b1a0f659ef3e76892b7dd784be41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897557, "uuid": "f013d818-5c79-4b72-8846-ae9824ca5f86", "comment": "Malware payload (Mirai)", "value": "18853d5fb5931f6c7615d4887fa3baa33d785c6a96fcf6f4880e35c3022449cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897557, "uuid": "70f7dd5d-fc0d-4536-9d51-ae20e1d71896", "comment": "Malware payload (Mirai)", "value": "77b8bc01a8622501f0f2e675de21b719c4032ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897557, "uuid": "1cb22e16-0092-4113-a978-6b3a7ca2c5f4", "comment": "Malware payload (Mirai)", "value": "4f72598a94753f9678e912292f2e80b7211575dc6a9682b24175098f7ecb0010adaadcf0cf53051f6e4060b1275454c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897557, "uuid": "fe7f1210-cd7d-4dd3-ae1d-5c5666f60764", "value": "T1C513F292F243BC20D115DC3D1876D17FB417FE2643828A33772DA51A496A15EF6A1CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897557, "uuid": "2d9d40b9-832b-490b-a41c-c9c0c8aa2877", "value": "768:lH0SAVypVXz7PB0ZnEoXn4kVScyXiipMyHoOFEZjfgsq:lH0dVy7Xz7PB6X4kVScyymtEpfgsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897557, "uuid": "946608eb-8d45-4eb2-b28a-ecc616136189", "value": 44016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897557, "uuid": "cb3a1d89-3665-4261-a9ef-35d135d020f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897557, "uuid": "264692ae-d90b-4064-a859-dedeeff5e9ef", "value": "dd23b1a0f659ef3e76892b7dd784be41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17521987-0be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686876758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876758, "uuid": "74a46392-1f97-44e9-95a2-714cfbfde4e2", "comment": "Malware payload (Stop)", "value": "a1cbc6ea635a45c6d06ac4791ade42bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876758, "uuid": "008e811d-7a47-4942-a301-141b4aaf672a", "comment": "Malware payload (Stop)", "value": "18a286151a945cf91548c05bc4b566eebbed37f71061fb0f4ad7e884d96edb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876758, "uuid": "561adeaa-db86-4aaa-bcb9-eeaf0611ea05", "comment": "Malware payload (Stop)", "value": "6ddcec4464962e0877204561b00e13442013dba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876758, "uuid": "b3866027-fbcf-45cc-ada9-527b565fd05d", "comment": "Malware payload (Stop)", "value": "cc6b1d404f21afb7753aaa322e6644932b8113354893591aaa2ceecd13ac83a73098365e806852c58af1541ef80716ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876758, "uuid": "b3c82fdf-5db1-466d-b18d-b1dfb83a1e39", "value": "T1C9F40222FEF0BC72D071C7729D29C2A83B1DFD518E14679B172C6A1F1AB02A19972375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876758, "uuid": "cc4381fd-a850-4c64-8e04-724ac524305a", "value": "99ae33530ebff97e88a1ac2c3129a9f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876758, "uuid": "d1a36ae7-bcde-4a40-b719-af3c822b8948", "value": "12288:t7LUWXHNXEZr7L8etLp0OIVh4RPXSHuW4IuL75Snfsddbtmm+Y7bTC0l:tEuHNXEVLL+v4qH/un5Ypanf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876758, "uuid": "b717f892-916a-4021-b393-3473bdd75a16", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876758, "uuid": "98c08ee6-d56b-47e2-83d4-170553fb7bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876758, "uuid": "4bc3d8aa-bdd3-4ed9-a25e-d2bcf8cfde6a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73392cb-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900300, "uuid": "76f39805-cf38-4b8e-86e7-2b83ba631c43", "comment": "Malware payload (Mirai)", "value": "5a96ed318b8175db3f6b1661b97ac42a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900300, "uuid": "682f1f72-d639-49e9-b9c6-58ca28a45f37", "comment": "Malware payload (Mirai)", "value": "1951086a0567cf004604beec843d939b943eba7d14952fc3b539ef2b1975551b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900300, "uuid": "1ea53273-85d4-43f5-b9c8-bfd09a855929", "comment": "Malware payload (Mirai)", "value": "29906c37d8f38eabe0229e5d5b2612bfd264770f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900300, "uuid": "cb9ff5d0-0401-409c-8d2d-66ddaa0c045d", "comment": "Malware payload (Mirai)", "value": "48cee029f4de309e417b85b8fa26620bca72a9df9d3e365fa780a226159be456550d6aaafb9f59bb08eba4b0fb9a7060", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900300, "uuid": "a5eac4b7-d4ab-41ce-a892-9284c6c5f732", "value": "T137432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900300, "uuid": "d10d74d8-ff95-40da-a1e1-6b6dd2c0da1a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwu:RqtmZPuutfbltZFBSJsBcfDSTFI+BEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900300, "uuid": "57612612-bfef-406d-a7d7-e5c8c2e982a6", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900300, "uuid": "32b13566-3d76-4fcb-88e7-c4880635d2f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900300, "uuid": "829f1d34-2b77-4dfc-b184-d50cf1eff592", "value": "5a96ed318b8175db3f6b1661b97ac42a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8329c663-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937069, "uuid": "3705982f-26d8-40a3-b92b-8390f9c92060", "comment": "Malware payload (Mirai)", "value": "c5084942d40d15358cbacd879b9e1eb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937069, "uuid": "d6a1303c-38c9-41d1-bedd-54eb8d2fd509", "comment": "Malware payload (Mirai)", "value": "1978b772614ba205adca27687c7b45b4e89d25c29de7655c51eb8b4544349126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937069, "uuid": "f5c828b1-2179-4ad3-a5ae-7584b2e05302", "comment": "Malware payload (Mirai)", "value": "fc959cb7fa32e8b6be1d90c2d9f1b74db5f6ec6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937069, "uuid": "623f9b6e-b267-4344-aa73-fd9989fcb39d", "comment": "Malware payload (Mirai)", "value": "04d7e1ea0be823904aeb659c27b975962f16f1e832365adabaf3e150b67825131945945e1dc3e6f44b2d79b3c33c2f27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937069, "uuid": "9fbd14c8-cab3-463a-8269-0f7eeaf837e1", "value": "T18EB2D0E48BA19706C6B0B436D37CCF925A3715E4C6F639262B2092BCC55285633FDAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937069, "uuid": "a41046a2-8052-460c-8d54-8546bede6376", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BRL2cQ5gMhymdGUop5hu2:4GHKQFH0rs3zWoDDRsjt7LB9U+BkcQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937069, "uuid": "75a2fa68-e155-42bf-85e8-1a61288980d6", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937069, "uuid": "9e4e7026-05f7-4e42-835b-5373874e3155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937069, "uuid": "b7362f98-7f4f-4101-a5c3-d149e93c7050", "value": "c5084942d40d15358cbacd879b9e1eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24058c97-0c18-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686900831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900831, "uuid": "c4c60ee2-8227-4fb4-a075-baf02a137e22", "comment": "Malware payload", "value": "e6a22086f8a93ac2e086c39d4420f571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900831, "uuid": "84976a00-b4a0-4c6f-a6e0-06f593b1c76a", "comment": "Malware payload", "value": "1b40fbe0f68620ca272f8c64fb105d41588def9466f3894745fe8a9607c36326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900831, "uuid": "62116889-106f-486f-a83a-3be1152a5e9f", "comment": "Malware payload", "value": "6fd5944886d8aa76521ce7c953294dbe252415c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900831, "uuid": "621dd84f-8930-475c-a1ca-8a3364572b68", "comment": "Malware payload", "value": "d5390e24174cae903e380dfe7a0dd9819a57f13d6f82af756c55090cc6df90ccfd7bec54b9c5693185f73f513fa2794e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900831, "uuid": "a286caf8-3688-431c-bd69-d63af9d28042", "value": "T1B6571231324EC52BCA6A05F0696CDA9F55287EB20B7154C7B3CC6D6E1AB49C31732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900831, "uuid": "a31fcfaa-ea48-4163-ba89-640ebc5589aa", "value": "836688c7d21e39394af41ce9a8c2d728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900831, "uuid": "9a069c44-b2d2-48d4-b802-9a596b620e37", "value": "786432:g3IeMgVP+jBeAo/GgbB6Xbl7ZS11O0JmzCs5:mIJIdOgt6ZkjO0Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900831, "uuid": "cdd81c30-08f7-4ecd-8f41-35419d254e20", "value": 27989152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900831, "uuid": "e42a3363-90d1-4313-bd4d-fb794768152d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900831, "uuid": "0a7dd5c0-61dd-42cd-8b80-597ffb4577fc", "value": "huorong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ff5965-0c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686919484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919484, "uuid": "82521d7e-bf73-4d00-8c14-5ab7853f53c8", "comment": "Malware payload (AgentTesla)", "value": "df15944df05963c70ff0c711a52326c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919484, "uuid": "cd32c26c-fcfd-4a58-9a99-cf1348058746", "comment": "Malware payload (AgentTesla)", "value": "1b6947cd98eba98ef22bccc5434f284cb7d75d80bbda5218a02b6cbfdaf35a83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919484, "uuid": "9931e002-bcae-4fab-931e-445b0b4c9452", "comment": "Malware payload (AgentTesla)", "value": "56cfe99b70985fc51029efbd6116b912106e1526", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919484, "uuid": "534f4958-27e9-4bca-85d7-a3784be7e136", "comment": "Malware payload (AgentTesla)", "value": "e4688c124633b5367f2e443407d5b43a89db3b03d1cc188b4c32a4fd7aa05cde275881bac721a81ea0a649b56629f78b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919484, "uuid": "26521795-f915-4f5e-8925-c348b7749bc3", "value": "T11054234853A2D27FE7B74B711AB9937D9DB66E023AA6671F37744F0831A11C0850E33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919484, "uuid": "a402ef81-a0d9-4c8f-bdb7-7d6dc6716033", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919484, "uuid": "0bb5ee6a-a75e-44dc-9d76-c923eb7efed4", "value": "6144:/Ya6C0Zy+bz4s25YxIGLh0dyqYp9izxisWr+yu6Pa1RxR+EY:/Ys0g+v4s25ELh0QqY2MsWC6MrwEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686919484, "uuid": "15517221-1396-4cc3-8e34-83afca80adaa", "value": 289532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686919484, "uuid": "0fd3daf0-1eec-4702-acdb-01e2c96d7ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919484, "uuid": "b4a2b0ec-f505-449b-a7fd-513107811846", "value": "rPaymentAdvice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1041fe-0c36-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686913889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913889, "uuid": "56847ffe-e1d4-4ceb-878b-59d2803e872d", "comment": "Malware payload", "value": "cf69db8ee25bcfcba91025a91b63e2d4", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913889, "uuid": "e9b2af12-e7ac-48d8-8d07-4744a13e806a", "comment": "Malware payload", "value": "1c26f9f2cc88b6a175cfcdfe6c162def1327e0d8cf759eb9540773f3343c98d3", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913889, "uuid": "ad425d08-1994-4572-a9b8-4fb4f0584c41", "comment": "Malware payload", "value": "98a18031627b4813c48b589e56bee865ff743fea", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913889, "uuid": "b0e35b51-78a9-4d22-8431-817b6935c197", "comment": "Malware payload", "value": "c7a9ccedcefbcae7b4ac1d1cabcf6696fe82daa718b8cdc35ed9402d4a906f9fca23de562a673d06a4df4860dc3f6f6e", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913889, "uuid": "59ca068a-4106-491a-8480-d1a31629b329", "value": "T1F2C2D02B1130502F57799F3DFE3ACC2F483335991342B0EE288C5914AA2AE99D6DD797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913889, "uuid": "3aedcae6-76f9-4cfe-8941-9ef595c1f736", "value": "384:B1WA3ox8ytJl2FBCqjok9f4D1/8hIo6J/F99XLTYm6imwz4OYah1vNE6zMU6R:BcAgDyLjW1cf6J9997i30L6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913889, "uuid": "16e26791-90a6-4714-ba78-a93d498a956c", "value": 26207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913889, "uuid": "3627a81b-269c-4bf6-a48e-9ce0cc2cf1c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913889, "uuid": "65241e2d-5a14-4330-bd0c-75da2d1e3b2c", "value": "nPayment_Receipt.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20208125-0c5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686931319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931319, "uuid": "1f6fea5f-33a6-4a56-b689-45a44645fc16", "comment": "Malware payload", "value": "6e664a49425103c5c6439deed5ed14b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931319, "uuid": "5c8e7987-b34a-450c-9ca3-ce0009a4b3fb", "comment": "Malware payload", "value": "1c70f987a0839d11826f053ae90e81a277fa154f5358303fe9a511dbe8b529f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931319, "uuid": "2a1e9ed6-3795-4ac2-99fa-df937a832d96", "comment": "Malware payload", "value": "46cb3226a0483d5f0d3e84bb12d0a140fe818c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931319, "uuid": "b0d8820b-ac56-4fc8-9201-15a2f2f2187c", "comment": "Malware payload", "value": "22498ba249d86e26bf79d45ef0cefe918b143f23b04e1d4dee826f4b4a46f45e24d9667460795bcc2a59c8d54b86c182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931319, "uuid": "070fcddc-d135-435d-97ad-6d29e29b0e35", "value": "T1E5E42835E69C32ADD16A9038FD0B5C13E626789E1321BFEB12D45A521F66EE04F3D360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931319, "uuid": "17323aff-9e24-4ff5-bafb-51e0d5621828", "value": "055b7f3bc7ff14f379a5a350e33b08c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931319, "uuid": "141dac23-1d09-428f-b383-2192b83c81c3", "value": "12288:XPDUcTiaeAdOYrdhu5QU2ajd0YPThtY0AJzSo4uhaUv:fD3i2hrFUXjSYjY0AJeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686931319, "uuid": "720d35e5-2ccc-49a5-8f99-f39efebee695", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686931319, "uuid": "9470fbbe-a914-498b-99c9-0e7e6432c7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931319, "uuid": "bf24e61f-dac8-434e-b022-94bddd12fb89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bcdd37-0c29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686908297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908297, "uuid": "fd4b0d63-37d6-4ea2-9cb0-c17d5fc338a3", "comment": "Malware payload (Rhadamanthys)", "value": "af5f00156e87d70c458dc7772abb2d7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908297, "uuid": "ea2787f5-c42d-4f8b-a8c5-eb795999c2a7", "comment": "Malware payload (Rhadamanthys)", "value": "1ea3b1f1f09de73b2021a37ef523a55ec13ed673a584e9fd25d80466e806ebf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908297, "uuid": "d2d04c10-923f-4e37-9aea-f72230cf4c2d", "comment": "Malware payload (Rhadamanthys)", "value": "38cf12b7b9f1f2768f514c35fdcd0f8b1f26dd2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908297, "uuid": "9f34232b-42ee-40e8-a54f-6e82a3207f96", "comment": "Malware payload (Rhadamanthys)", "value": "c0a7ca0d25495e513a688a608bdee2da31382e588d1563c21f561b93a5f8a65f00dbf64c62d74274d1afc54bcf2e9368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908297, "uuid": "bd0a37eb-a10b-4aae-9c95-ac7f0200826a", "value": "T17FC4AE13A2F4BD50E6679B728E1FD6EC761EF150CE297F68121A8B1F06B1272C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908297, "uuid": "497df1ec-e85c-4791-a237-e682e5e3c753", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908297, "uuid": "57d8b3d1-8945-411b-be86-ac625f36c04f", "value": "12288:6RRkZ8Xl0+xZ9RAZKfrkLPbTGmBxx2ARiu:6nc8KrcfwD3GUxIAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908297, "uuid": "d40f7e39-fb0f-4e45-92f6-22541954783f", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908297, "uuid": "cb003006-77ca-4211-98a4-5c792e43baae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908297, "uuid": "701ac6a0-18a8-4ac5-b3db-acaaed3feac4", "value": "af5f00156e87d70c458dc7772abb2d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac008bd-0c81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686946208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946208, "uuid": "ca71b147-db92-447d-9ec0-e92e2b191603", "comment": "Malware payload (Tofsee)", "value": "1cdcfb0d99e2e32fa3a98f899573618a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946208, "uuid": "6e508916-14e7-4d94-ad84-4be97475250a", "comment": "Malware payload (Tofsee)", "value": "1eb4b34e8eac69654790bbd1a611ddc2f90247c571ddd5bd7761ad224777e1df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946208, "uuid": "a96e9d07-22e0-4399-952e-654a263aee9b", "comment": "Malware payload (Tofsee)", "value": "99ea91e565d158a54cf5939506aaaad0592ef31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946208, "uuid": "95d3b4df-d11d-4937-96d7-30d701549932", "comment": "Malware payload (Tofsee)", "value": "9924db9dffe4824deb23f28c70fe8b4b34fea4a679e3fdf7baa382be140fb777983cc3e8384a3fbbc82be20955ea77a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946208, "uuid": "a2a607f2-8f97-4cf4-8fb0-9b527183b7d9", "value": "T11F64938392F23D44EA66CF73DE2ECAE8761EF2508E49776D5119DB2B04B10B2D163721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946208, "uuid": "59f64027-9ec8-4e42-9dde-75c2b25a93eb", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946208, "uuid": "68da8e04-dd44-477d-8672-5e320ac8de04", "value": "3072:n3RO25bnkXo+uO/5sR40RryEWgJ5zxGlsfgy8bK4b1Ararb/QQ5qZwh5TveCV8a0:g25gocsR40ReeJNMsWRbXU0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686946208, "uuid": "a53be6c3-7d65-46b9-b129-7ab385e971e0", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686946208, "uuid": "7181c357-966d-40c2-8fc2-cfcb7253509b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946208, "uuid": "bb070a18-8f09-4156-abfb-bd6a8f1a250b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15b379a-0c26-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686907081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907081, "uuid": "818c60e2-4943-4d9a-87ff-5c9d72c0784e", "comment": "Malware payload", "value": "c8eb4d9912947bf336aaf25e70ccd966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907081, "uuid": "461d7779-b385-40da-9dbb-1147d8874a8f", "comment": "Malware payload", "value": "204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907081, "uuid": "6a0250f9-ba73-48cc-b03e-452961bd16bb", "comment": "Malware payload", "value": "94dca78baa44dfbc0a95dd5b82565309ff20bf11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907081, "uuid": "d95f0942-8b4f-4b92-9085-41d700cc3e7d", "comment": "Malware payload", "value": "a650e4c58ee70c8f3ca1d9a71f3d2b72b4135fabdb17df2852d03a79e71ff832cc7744a83f6d8b2bf8ad73c9d3f13d73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907081, "uuid": "72a93274-cb29-461f-985d-8d52b02b6012", "value": "T130A422395B168727D04F83F5AD202670877EE3C9B917CA934DD3B2E9DB41B220914D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907081, "uuid": "05a9e92a-65cf-43b3-ac36-83793ca479e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907081, "uuid": "a269d3db-d8a5-4f43-bf07-aeb5c7cc8d51", "value": "12288:P5LbzIu9+r96fDF/Alp5l8NIb3cd0J5jFJKhBx:P5LA92/yHvMd0JJFJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907081, "uuid": "164b1905-f1c3-4d51-aea2-3f0a0634d1d3", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907081, "uuid": "9526caeb-8a1b-487e-9bf6-82344f6e00cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907081, "uuid": "13399404-536a-4835-b110-3f8b052677ba", "value": "UPDATED STATEMENT OF ACCOUNT (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be851b7-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897543, "uuid": "796933d0-aea9-4792-8c77-d5aa4a4d1e7f", "comment": "Malware payload (Mirai)", "value": "8060885c9182642f311d8930c0e59be4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897543, "uuid": "c923acc6-bd4e-4a04-86ce-3ccce566f984", "comment": "Malware payload (Mirai)", "value": "20e433b0cd97d8db6c7c78b4d1422175f108508bc9b1214e402426125ac20e54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897543, "uuid": "2a33226a-fb83-4ea3-a627-3cb0d33f42e7", "comment": "Malware payload (Mirai)", "value": "daaab26132967fc56d31edfc1eff208af3b95008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897543, "uuid": "8b34b0d8-884e-4f23-ba77-0af193a55fc3", "comment": "Malware payload (Mirai)", "value": "be8f332331b4228f8cdc8220bf92fc164ca5ccad6787c82d45239953e51d6be803a22c49b8efe031b699a98c43148cba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897543, "uuid": "7970ff3d-bea2-42e6-85a3-3b54755fa909", "value": "T192D2E09976D763E78CCDC9BEB20F4036309D74AA76B29323B305D8530B7A181E651E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897543, "uuid": "6ce1050b-369d-4b32-a113-bbe267d81e91", "value": "384:MId/PxEDLd2TwMWzB6lowYcENqs+9OC450LQixBfE4jdlz0lewZ90BKYyeFtNyv:blxKd29WcxEos+V6IHE4RlY990Sewv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897543, "uuid": "64dd06a0-dd2e-4355-a875-ebd3c721eb49", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897543, "uuid": "b27c34a2-7deb-4dd5-8872-1b1c3fdaf55d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897543, "uuid": "266fc444-7ad8-465d-bf27-7c4e60ee2b15", "value": "8060885c9182642f311d8930c0e59be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be60501-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925728, "uuid": "a808b423-bd42-4064-a227-defb6f2b6a51", "comment": "Malware payload (Mirai)", "value": "5b1b34677b3e20d7db9c7ffc6f4702f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925728, "uuid": "7ddf75eb-1859-44ad-946f-01ce66106aac", "comment": "Malware payload (Mirai)", "value": "21174692e8013373b36f51c7bf1a16715001c9564e887213e05d1b0176de8e5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925728, "uuid": "d26c947a-66ac-4c14-a46b-6b27d781445c", "comment": "Malware payload (Mirai)", "value": "e2eeb2d1864ed87b107c9fdefed03742558dff01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925728, "uuid": "c8a64f70-2b10-47f8-b328-64e1b6730e6d", "comment": "Malware payload (Mirai)", "value": "084c49675593c331c67621eea2d59f1c98550739beb9ebf7b8f4543097a72e2b9a6d069e7f8e2ee6ce7c5c304b3b3c90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925728, "uuid": "3e64c334-2f1b-4118-ae3a-4e02f119428a", "value": "T12C835B22BA3A1E23C0D5A07B11F78712B1F113CE25A8C61E7D721E9EFF255406583AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925728, "uuid": "44cfe0ce-ce98-47cb-8af4-a2790c358b5e", "value": "1536:CCX1za6CuYbVh0wEgxw+mM9/n+LHKkesOzh0DLniBd6Y3rTEVT5KAlStHLwbZn2c:5PCuYbVh0wEgxw+3iXi5AVNKAULwbZnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925728, "uuid": "cb5da001-c924-4423-abe4-1b985370bf35", "value": 83960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925728, "uuid": "37bd59ac-0a05-49f1-9ee6-4cf824567d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925728, "uuid": "ae3965f2-0d82-4bd1-a7b2-aec10cc79b80", "value": "5b1b34677b3e20d7db9c7ffc6f4702f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae8d45-0c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686905470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905470, "uuid": "b270a85f-9deb-4e48-9328-7dfb3c3eeeb6", "comment": "Malware payload (AgentTesla)", "value": "45b653aea68b6aa02473a5a26d337113", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905470, "uuid": "59cb5d3b-1394-4be2-83a6-de7f4dc6ef92", "comment": "Malware payload (AgentTesla)", "value": "213c731aacc82ea20f97417a4adf5d4a024e52798d07f05b704711cb1f5c6248", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905470, "uuid": "e1cc4841-ade8-4c85-bbd5-5d5a4a2c3997", "comment": "Malware payload (AgentTesla)", "value": "2263add06725216018b2c7d10a36d4a7dd67bf7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905470, "uuid": "0826adab-daa8-456a-8a57-0c8262b85148", "comment": "Malware payload (AgentTesla)", "value": "5bb483cd1916e9b5cd468d2b2ce3ac7a3340e022bb04b05612a33046de9b2405f89186b03a9f9e32375690ace3c8e051", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905470, "uuid": "15e48a49-08b0-4e90-89c1-1a799f9586f4", "value": "T103D422A0E5665133E04B07F50121057557FB02AA308FE7E30DABF2E8F691BEA9601BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905470, "uuid": "e41e25cf-d715-47af-9d2f-693abf2d8c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905470, "uuid": "95f81131-3c23-44b9-b22f-1fdcf141ebe8", "value": "12288:dS5LbzIu9+r9gBhnhD3KAVRJcaENbh1JFPpJ3I4ETfUXlaTLIj:s5LA9gPhDhSbDJFhJ3I4ETccTLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905470, "uuid": "8853630a-0751-484d-986a-6c9465a567ee", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905470, "uuid": "1ab2aadc-9601-4993-af42-a76670b9648c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905470, "uuid": "7626beba-6afe-4e67-908e-8f7298452e94", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b292ac-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900327, "uuid": "6ff4cfac-5113-44c6-976b-0218c8a4e4ca", "comment": "Malware payload (Mirai)", "value": "e00b71c3a4263236762a122f84e69812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900327, "uuid": "bf62a414-bee2-488c-95bf-8c6a5cdf37bd", "comment": "Malware payload (Mirai)", "value": "2204325b4918e6c9ccf153521b2e2116927ff8341116bbcbfeed5a02799ed95b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900327, "uuid": "47ee21aa-6b71-46d2-96f2-1444af0eecf6", "comment": "Malware payload (Mirai)", "value": "bb33c84a80c56d0a38f86110664b0fc3b2fd1531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900327, "uuid": "089bb153-3b2e-42bf-9a99-f6da07a57d93", "comment": "Malware payload (Mirai)", "value": "793c3ec0fd1e620230fe61af4426c33487bf4a2ae80c18e759c5d333d9e9889feb5fa3f9880aa401d945cb2c63443575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900327, "uuid": "db927731-e6d5-467f-982e-20a275bbcbc0", "value": "T1ADB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900327, "uuid": "86260f32-3631-42a9-b7b6-560ca0c09e28", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1h/LWy:c9sSyzz36YaWWgg1hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900327, "uuid": "5e10f233-d014-472d-bca7-6678f74bc1b5", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900327, "uuid": "fce5f714-73b9-4bb3-9fc5-b368d0ea0234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900327, "uuid": "b80707a0-103e-4613-8e02-64a7531a2d6e", "value": "e00b71c3a4263236762a122f84e69812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20bbebf-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686894654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894654, "uuid": "5b90d500-e773-415f-8333-1e718a4d17c1", "comment": "Malware payload (AgentTesla)", "value": "329bcd5a70b96270e6f2e310e75a0a42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894654, "uuid": "580c9c25-fdf0-4fd7-9cfb-e18550f38505", "comment": "Malware payload (AgentTesla)", "value": "22059817e04f84b60175d20e225c713482cd8091ecd4bb74a70946d4826da7f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894654, "uuid": "cdf6cd80-edc7-4552-987f-c1f38cecd701", "comment": "Malware payload (AgentTesla)", "value": "4ff3db18d389c2d89acdba0740405059f193b92f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894654, "uuid": "8478adb8-a8b7-4ab3-9f5b-79c3fc8ac3ba", "comment": "Malware payload (AgentTesla)", "value": "5d0040dcdbc9b60e0a4b36b17c9afd7fc5147219650f55bcc8a2590bad31a1d778d652c3cf3a474dc92edbda9fe1cd64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894654, "uuid": "103669d3-bef6-4f12-8386-2c5a67fda1d3", "value": "T199E23A146BF88362E5AD4B7E9471111403B6BB733633E32C5FC658D92AA33908A55BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894654, "uuid": "0f05e015-38c9-4e70-80f8-aca420519c10", "value": "384:J/IVY81CIzFoOt9eTmdIxrWa3huASlvgCN1iE7ZBNvWZXb95rZOVyYzbQt5z6HlQ:J/IVNl3tIThxJaLtSXz1gyYnQnal0wFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894654, "uuid": "62c6669a-ccf4-4f12-89b4-da3b45850e40", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894654, "uuid": "7c368845-4c49-424f-9e64-1de9b8115e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894654, "uuid": "76575d85-a391-49bf-be5d-cedfda27c6b5", "value": "SHIPPING INVOICE DOCUMENTS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b919c4d0-0c94-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686954339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954339, "uuid": "ec25a847-a777-4750-af5a-5402795d47c6", "comment": "Malware payload", "value": "681d1e7803a439a3cfeae19d984ba22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954339, "uuid": "ab0e0f8d-3cd6-4f37-8cb7-bcbef4dea1fb", "comment": "Malware payload", "value": "2238986fb7a16be5dad3f0c3f8d8cac880588e5e84127fc83228ffc6d7814eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954339, "uuid": "c746398e-a2a9-4251-86cb-73c676c747a1", "comment": "Malware payload", "value": "829eb4c94b0b905a3375221d09eb1894dcc08ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954339, "uuid": "c74b161b-430f-4293-b1a2-7f39c2bcf7e7", "comment": "Malware payload", "value": "93e2e827c43a066fc4b80ac93dd44f3cf9a1f3b40d90470cc8a217ef0a1aae280a42210439ed44032107359e16973e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954339, "uuid": "f2c23960-46f7-4f90-8ee3-dfed0013fefa", "value": "T19D052306B7D88632CC791BB058FA43D30F357D524D6E9AAB3681298B0D76BD06936373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954339, "uuid": "119d9dbf-f4e8-4a9f-a143-cbece6e6b00e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954339, "uuid": "aaa395f9-d8ff-4c14-a7f9-95ae4e8d46d4", "value": "24576:7yKgINmuCcF9u6jRY4YdEhbEUq0egrZkLlF:ufeHCkRtHmUq0ea+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686954339, "uuid": "e0d4104e-e609-4215-82ed-63d16ec7355e", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686954339, "uuid": "5e4c4a24-126c-4d81-baef-3f24933ee795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954339, "uuid": "63890d15-e5a2-46a4-ad19-759d7886b663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc619fa9-0c50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686925166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925166, "uuid": "3bc93e54-8b8a-4035-96f8-905280fe6352", "comment": "Malware payload (AsyncRAT)", "value": "0cd5c6adc81e279f857de8fb4e8f0333", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925166, "uuid": "7cfba324-14c4-46ad-b216-ca0e6506f78d", "comment": "Malware payload (AsyncRAT)", "value": "223e0ec97c6ebb70a8630e4bf352b57fea308cec476284e8f55a790a2e2fd558", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925166, "uuid": "6e2f7337-d4d9-41d9-bd7f-8d5c5ed8b892", "comment": "Malware payload (AsyncRAT)", "value": "4078a3d75146ba0ee28d7f905bca7bc643d78a73", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925166, "uuid": "176e2567-b847-4718-bcf7-262306660e62", "comment": "Malware payload (AsyncRAT)", "value": "98eb327a6366c0ae63b56da1f9e92b9e7e211ad47a9f60a47ba70ec87a8823ef688b5713a75e80a3297fd21af3f15b68", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925166, "uuid": "9969455c-cefa-41be-9fbb-cc08504a170d", "value": "T16E236D0037E8C53AF2BD4BB5ADF292058775D26B6903CA5D6CC414EA2B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925166, "uuid": "0fa544d9-9ba7-4381-affb-391736762113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925166, "uuid": "3c632d0b-298a-4c60-9625-27aa9c3f3fc2", "value": "768:xGq+s3pUtDILNCCa+DiVjiv+8YbQgN3/jVgvEgK/JLZVc6KN:8q+AGtQOfzbXNLOnkJLZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925166, "uuid": "586043b1-873e-41f0-9edf-005189a8cb64", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925166, "uuid": "d7f23de0-8fa0-40f9-a180-f2fa78ef1371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925166, "uuid": "858667de-9d8e-4978-9e7f-ca5147474bbd", "value": "x4Gfk4dkwuBd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d9b996-0c93-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686953721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953721, "uuid": "fae0c173-44e3-486d-ad7d-a67b5689b417", "comment": "Malware payload", "value": "84219cb3d6ccec7e0520e9a21c3f1d5f", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953721, "uuid": "c0c47ae1-73ea-4101-b92e-a0c6e0f8a2fa", "comment": "Malware payload", "value": "22c9e750c38078ccaa1ba4d54fdf08a8974304fd761620a164c8804f12601787", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953721, "uuid": "6925d819-6ec6-4083-a16e-15b7a49dc321", "comment": "Malware payload", "value": "f689e8a1462e35968a797fc67e018bc4146dfdd9", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953721, "uuid": "57d67713-7a71-4965-9753-827caa9fcb4f", "comment": "Malware payload", "value": "38de27f0d1b10fe561df0d8f7eb94a0cbc4db73038f5c5dbe6839fa2677263b9e527a6fb0084cbb407615bba276eb4b1", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953721, "uuid": "704ce604-d9ea-430f-ae6b-5b20efcae460", "value": "T14361B0932151B8EA414287BF3D5A6AFA807FC224914A7044FB8C4F9DF9DDE63398D2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953721, "uuid": "bf7a4fa7-a8fd-4026-8d9d-8a143dd65f35", "value": "96:vGT7xJ/fuSHWvD+CfBZL0HgMmAiBrVM/H:sFJEvAHgMmAiBrVqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686953721, "uuid": "61218bdd-451b-46db-8dd5-dbd743a5eb5a", "value": 3255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686953721, "uuid": "5c4e749f-5978-4dae-92df-73826bb5c2fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953721, "uuid": "fc42f3d5-45e1-4215-abd3-fdfd0db9f087", "value": "XQMuW048.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b070ef3-0c50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686924895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924895, "uuid": "285af7d4-a366-40ef-9771-927ba06ecb81", "comment": "Malware payload (AgentTesla)", "value": "dc8d905925b5e49f40cc558a37117ac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924895, "uuid": "f87b2b73-0a1a-4c50-b500-c59be7814cb5", "comment": "Malware payload (AgentTesla)", "value": "23a80d3ed45bf211ad90814dd5180e6a9d1cc9427d354bcfe344a44537f1d1a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924895, "uuid": "c47abb22-77ee-408b-97cb-be59e677d8c3", "comment": "Malware payload (AgentTesla)", "value": "3591eeec383967dfb01ca3f84acdcdbc9e62220b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924895, "uuid": "159625fa-532e-45bf-a9e8-43f5c69e4530", "comment": "Malware payload (AgentTesla)", "value": "785815626a5e7933e8079ceb5c5677dfd6c4027d777dbcb8ecb2b05aecfbdda0f757a1e00cefc0ee781d4b9bc9051d97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924895, "uuid": "a1244500-94c8-459a-85e4-381371126182", "value": "T1AD050241A8AA4F17E276B7F90F00737433FE6EC92815F38A1E87F0E59524F481A51A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924895, "uuid": "f55c3221-deb8-4bb1-8242-6c4f28fb9d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924895, "uuid": "ee3bd867-3142-4eb4-a291-eb958d48f8fd", "value": "12288:H1mcvG73htU7/2eQ1x94+sZasdeOD5nw53yF+/c3MeFFx6ngpvVnbysK:AgG1tCueiZsZJD5m3fc3fPongJVul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686924895, "uuid": "52bca2e9-1eb0-4ba6-b7dd-4b1d80ec5624", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686924895, "uuid": "a35946bb-fcd9-4108-9cc0-94bb84dcf085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924895, "uuid": "1c28139d-6764-4559-b5b1-84ae76ecf63b", "value": "PO-10152023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63c0841-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908915, "uuid": "15d209b0-673a-4359-9704-ed893cf78790", "comment": "Malware payload (Gafgyt)", "value": "1cdbfbef2ae7d0b06ebf942a4356d021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908915, "uuid": "3b92ba48-50a3-4bd1-94b7-622364bef3a2", "comment": "Malware payload (Gafgyt)", "value": "23d830264bb343b9c9c2bd2112f1aa704b2b181e82f5250aaea282d6d735cc0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908915, "uuid": "f3adac03-c6ca-4481-b00d-e1d1adc843fa", "comment": "Malware payload (Gafgyt)", "value": "aaa7ab12a2d696484f8e75e34508d22b6fc1fabc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908915, "uuid": "a5fb8052-f157-420d-a6c4-861b02c5f5b4", "comment": "Malware payload (Gafgyt)", "value": "f8b9ed6298f9dd769d48d926a86d4e1c59b87bc67e8b2a866d76fdf31c1d5667cf55f8be07310e5fc18c1e16872c76b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908915, "uuid": "8f5fd205-a4a9-408c-8e90-55d0d459483e", "value": "T1BCA34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908915, "uuid": "943a6814-98e0-4f8c-80fb-55f71704e38c", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7v/CEgmqAgcVyZIcBI:Yf5EdTbpr7vWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908915, "uuid": "3fa57f07-ca84-4120-b065-efe5a6ca810d", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908915, "uuid": "87c77334-7ef6-4b24-b122-47d038f11473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908915, "uuid": "b877a6cb-c70a-4723-adab-8c215b3cb946", "value": "1cdbfbef2ae7d0b06ebf942a4356d021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb01cc6-0c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686896388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896388, "uuid": "374bf97e-f6a6-4f79-a1cb-91117daf76e5", "comment": "Malware payload (AgentTesla)", "value": "7fdd542cb7a738fa14dedca5fdd139d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896388, "uuid": "5c4630a0-3e9f-4578-bb6b-55f5a5d7c43a", "comment": "Malware payload (AgentTesla)", "value": "23e850ea6942dfed5309aaed77e4914d537be931ce9cf9673114cd6409b7af82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896388, "uuid": "2c1455c6-9fcf-435d-8057-adb3fe52d457", "comment": "Malware payload (AgentTesla)", "value": "43322db0cbd4a2fc0509eb43195daa4fcc1fc88b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896388, "uuid": "4bf72398-01f3-4147-a3a9-d3013af9482c", "comment": "Malware payload (AgentTesla)", "value": "19f3ced0be494a5911b2dd8595726c05354f3424bbb1cf5f0ef2ab106c886a6f5744f2928c7ce73493e9480056301070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896388, "uuid": "6a34415c-da3b-44a4-9fef-7fb0d51b6ab3", "value": "T12EE4232947BC60DB696898FE8807E0005B8CB1E5E315167B0A8B0AF5B7F9F7C9E45F14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896388, "uuid": "a9b68a5e-f883-47ed-b02d-c91d0b9d5fc3", "value": "12288:HyA1v9zRyFZaTkFi00xsHDswAA0wnif5XQRy6ER2YAWErd+//ZV6heLOEImw:SAuQgMejsx5gy6ER22Er8/RV4eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896388, "uuid": "69da42e9-4d3b-49ac-af8a-20bfb78a15ab", "value": 713289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896388, "uuid": "ffe1f151-dfba-4628-ab6c-e020c8e99285", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896388, "uuid": "0d68e987-2fca-4cca-8bdf-67570f3fb12a", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9fab4f-0c77-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686941593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686941593, "uuid": "0ffa5787-f743-4322-9c5e-410efe70ee0b", "comment": "Malware payload (Formbook)", "value": "bbed573d2d2ee2f04d010ce998a5fe46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686941593, "uuid": "53113449-2d83-45aa-8469-b72b47acee1c", "comment": "Malware payload (Formbook)", "value": "25bcdc2a0b67ac391f676b51e55bf74c686eba2fd04ee074b5a7f1af9610e864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686941593, "uuid": "cabde550-f6f5-4e20-9057-97d8c3ca0e59", "comment": "Malware payload (Formbook)", "value": "74a32deb53c80e093b0a339ac6b72378669b2ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686941593, "uuid": "30875f7c-b421-4b66-891e-e04c456bcae9", "comment": "Malware payload (Formbook)", "value": "d1830ceef3f3b7b2de1fd351811eb5cdc2347332c223d6c2df6fb0e11cba3ac6123a48a09b78807af4d98ce456a7079a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686941593, "uuid": "52aa1a2d-026c-4590-aec5-eae5e16bfd84", "value": "T1FE05E041327A2963EABECBF5015151B097F62F1FA11DF2E84CC6B0EB52F0F844A51A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686941593, "uuid": "5019b351-0cee-44d7-8518-2951c41a9597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686941593, "uuid": "40287305-d950-428b-bdc3-3ad805e12960", "value": "12288:glKnu4EXqXdVi5h1dIoTgCwb6r4O0VxD97UXYpctJrG1aaBriTw3k:F14qXdVibNTYb9O0VxDScGE1pBGTw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686941593, "uuid": "98597337-a131-4975-bf42-b8251c0837bc", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686941593, "uuid": "ae122c5c-a7d2-4b98-8486-5c444fb0502f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686941593, "uuid": "2d459f0e-8514-4dad-9380-372c9ef2d586", "value": "payment copy$10,200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f27443-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900271, "uuid": "a82bba3f-e41c-4f1b-92f5-c42233bb3176", "comment": "Malware payload (Mirai)", "value": "2a971af2815ce18e482fb0d858c280b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900271, "uuid": "ed161581-3751-4691-a01c-22c006acc0b4", "comment": "Malware payload (Mirai)", "value": "287963e2d363363dceea3c9d2adf8449d8b99444fe6681e41ecb10406857985a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900271, "uuid": "42072e51-52b2-45fa-82aa-d124d5a271aa", "comment": "Malware payload (Mirai)", "value": "172c1b33881d77018ecf44b7a4b27644d5bcf006", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900271, "uuid": "253e3ad1-1d16-4b72-b1bf-75c5e425b38a", "comment": "Malware payload (Mirai)", "value": "4e9db9923144d127347d723548f2d6d9f723d6b8feb542be2658f51494b171ab84892a03da801cd4bfaa50d52e692549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900271, "uuid": "3dceb575-f947-49b7-92ba-2629ddcff53c", "value": "T1DD33023CD643AE26C1901F37ADBC21D9274EE2442BF87067AE2488156ADF314D9F65A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900271, "uuid": "55b2b6e5-db9f-4b32-b473-e441231cbc4b", "value": "1536:mdd1qCmzrnFx27Dn+oWwd9ViE+AJV7rUoeLgVE8aCD1:mYCDVZd+e9rUoeLwPD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900271, "uuid": "683a3d1f-846e-42d9-ba2f-d65d7c288d8a", "value": 51464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900271, "uuid": "869f5edd-00ca-462b-87e6-d494d8753173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900271, "uuid": "4bfca254-a528-4ec6-9c18-6076dc337b39", "value": "2a971af2815ce18e482fb0d858c280b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169b69aa-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925720, "uuid": "7a8f3271-0a16-4b3c-b9de-7903a0295aad", "comment": "Malware payload (Mirai)", "value": "148fc3e25923c1cd7905a7df850c2722", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925720, "uuid": "fdadd96a-9f5c-48e3-ac8d-6ccfd8b766ad", "comment": "Malware payload (Mirai)", "value": "2abe708817e64547c2999a7dd1d2d7f368be932ef0ae25ed12581f9010b178d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925720, "uuid": "ebba3701-e941-4f53-af70-ab23d729428c", "comment": "Malware payload (Mirai)", "value": "ccd8f9dede705799055d26d729d6f521120b27c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925720, "uuid": "ba72acf8-fa63-4f86-a205-3c5b2a48d857", "comment": "Malware payload (Mirai)", "value": "98fb913ddef0ca02c16331a1097ad7aff4c65aea6d4aefc929b0279f885a496e0aee1d5384409c7e80b844521e79a590", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925720, "uuid": "fe555874-9d54-4c99-bb68-8ace5c8a1316", "value": "T151F2E1D084C11470E6F02FB5CC898E436339E8F8A5C966BF2364815CF9A5572ABBD8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925720, "uuid": "3587a40d-c9b2-4a5b-a949-4d4c806d9a54", "value": "384:B6Xt5sFrU1bU05GNO2uhASCvI6vnRoVEQRKe15GCLLj2m/xdw+qABDrBN7k4YnR2:4krmh5/hxCfRmAe15GCLLj3fqRi3U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925720, "uuid": "1d65ba54-64ae-4875-a0d1-58b986cd2131", "value": 34584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925720, "uuid": "0502d099-bf00-4973-80ea-eaf05dd19e58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925720, "uuid": "93757d05-0d39-43a4-bc69-9a5a7e71e07a", "value": "148fc3e25923c1cd7905a7df850c2722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b9d65c-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (MedusaStealer)", "timestamp": 1686914098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914098, "uuid": "81c366dd-f485-431d-817e-c130b972f526", "comment": "Malware payload (MedusaStealer)", "value": "f1fec815d89e12b6214a62a5a0be2f04", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914098, "uuid": "775a7ca4-586c-4e50-85f6-25b7fb77672a", "comment": "Malware payload (MedusaStealer)", "value": "2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914098, "uuid": "9c3d7dec-9e2a-4267-a7a3-370eea50701c", "comment": "Malware payload (MedusaStealer)", "value": "92d27f9a7b2c8ef52e96903d58830f5f441fa3d2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914098, "uuid": "5ac3a600-8587-4a38-97c3-328d04efc5af", "comment": "Malware payload (MedusaStealer)", "value": "03135a191d191d9e00456ac68119a4e9366f6e5707952ce5e1bad72dc143e82fa58f32aa4b78a5c5ac6556292e722484", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MedusaStealer", "colour": "#E8D14C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914098, "uuid": "5e080fa4-aac1-446b-ae4f-3d423ad0e6b9", "value": "T1FCE42931E69C32ADC16A9078FD0B5C13E626789E1321BFEB12D45A521F66EE05F3D360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914098, "uuid": "184f821d-aa41-44bf-af0f-9d5aee18a6e7", "value": "055b7f3bc7ff14f379a5a350e33b08c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914098, "uuid": "0518a264-9307-46fb-aa6d-1f757ce7cb2e", "value": "12288:10Vzuj87ZA9O8Qdhu5QU2ajd0YPThtY0AZzSoFyhaUv:KVs8i5QFUXjyYjY0AZec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914098, "uuid": "a8e50858-e8d9-400b-a05a-071b15f6eb21", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914098, "uuid": "4c376ad1-aab7-4300-8477-045b0ec38205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914098, "uuid": "a7fe1202-88a2-48f5-b001-1eded7f3aef2", "value": "f1fec815d89e12b6214a62a5a0be2f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7b2cd4-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937056, "uuid": "b7b174fc-c0a3-491f-bce6-2bc3fb8db015", "comment": "Malware payload (Mirai)", "value": "7eb371914c0a1bf926081600361155df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937056, "uuid": "27fae2b5-6a8c-4c9d-bc64-0e99c9e819e4", "comment": "Malware payload (Mirai)", "value": "2b283b27ee5034121b02f17ce2d0c3b26dc21417d449c7e562e47a5110a506fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937056, "uuid": "b672807d-3bd4-402d-9aa9-f66d52b187ff", "comment": "Malware payload (Mirai)", "value": "4f969ac538b838a03ccd70c98775f7bdfa99c929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937056, "uuid": "cd021980-9eb3-4b02-a96f-64dfc711c0a6", "comment": "Malware payload (Mirai)", "value": "81c35f3fc23748109b64fa44e4506c69a50febb812633443157924620ba35287b67ac27dd02d215eeb355c63b34f6937", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937056, "uuid": "e141c20c-44cc-4823-a672-26177a426ccb", "value": "T1CDD2E14879C3A3F78CCDC57EB65E003630DD249AA6B19363B305E453476A140F652E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937056, "uuid": "3ede681d-ec42-4b4e-bfe2-598715ede92f", "value": "384:Mqd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKlUbkeNyU:NlxKd2FLPxEnspd6IHE4RlY990Jbk/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937056, "uuid": "558b41f3-b41c-461c-8e1a-db533c633a80", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937056, "uuid": "e05a549a-0821-46ed-8d44-058a3fcdd60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937056, "uuid": "86bce73a-b9d8-46d2-9c43-d41c1fb4d642", "value": "7eb371914c0a1bf926081600361155df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d922a8-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900700, "uuid": "27b640f5-e53a-4330-9053-7b1151926672", "comment": "Malware payload (Mirai)", "value": "c12872a6b32c32098850d776aa177292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900700, "uuid": "4d452136-f699-43b4-9a38-4b312c6438bf", "comment": "Malware payload (Mirai)", "value": "2c47c13b2e30f01cf20a8e70fe522ac754ef7452738e49929112f02b24426551", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900700, "uuid": "c08730f8-c5bf-4cfd-982e-8fcf0df8efa8", "comment": "Malware payload (Mirai)", "value": "7c9cdd8e35037f6e58133ce24d1db6a9f1027557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900700, "uuid": "ed43b31d-ee1c-4770-9960-c74877d83e26", "comment": "Malware payload (Mirai)", "value": "e1e40538839544f1d33e5eda2b510eca167d2d1c727ca4628b952c87ee26f72f0ce5c49949589773321983a41eab1e02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900700, "uuid": "befad067-6bbf-4af5-8470-cbf21a31363c", "value": "T1CB23F746BC81992AC6E0237AF56E50CE332173E9D1CF7667CC121B0076CA46F1D6BB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900700, "uuid": "6f1c6ee8-b82d-4f59-87b8-ccbd089c2bcc", "value": "768:PI1liF5PQcojYvrPW6OIuMQ4x8nTKSKw2DZTaN5FZSI/hr/tfZCJ9DnzXBN6c3:iE3QWr6jMQ4ATK62DZO5F8I/d/tfYJ9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900700, "uuid": "2e73bee7-95b8-4128-8d2b-8ba4fa5c07fc", "value": 46308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900700, "uuid": "4579e0fe-e44a-4d1a-a74f-4a19f4fb52f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900700, "uuid": "9bb05d9d-9679-4674-9773-efc25c2f3696", "value": "c12872a6b32c32098850d776aa177292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb3c6d7-0c5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686929464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929464, "uuid": "56297781-6744-407b-9d6a-7652912203cc", "comment": "Malware payload (Amadey)", "value": "f73478f96d098d501a5d5c6aa555b870", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929464, "uuid": "842bd332-b0f0-4fdf-bd8d-dd38f0ef0a32", "comment": "Malware payload (Amadey)", "value": "2ccd357e94ebb0dbc6b4dc7d77247c08474593d983b5c9cfd191a2f8c105bc80", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929464, "uuid": "18b6b2d5-00f1-42f4-bded-d785d1de9e19", "comment": "Malware payload (Amadey)", "value": "bc5fa90d2946a6fad64ca1b3b97799cce3a367da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929464, "uuid": "33b66bf9-7c94-425c-945c-81d398da8858", "comment": "Malware payload (Amadey)", "value": "e070c605ccc5c0dffc877fb382f80c1c89297a5c06ffe7b9c449ae7e83f6ebe2619521a6b330abef40d5c2e4713fe31f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929464, "uuid": "37ce41a3-9bdc-4492-a6bd-725bf71ddc30", "value": "T1C0052243EBD85432DDF457B43CFA0793063ABC625DB0926B6741A88E18F3999A07172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929464, "uuid": "09d3c4d4-4574-44bd-8d1e-44f4bf7e78d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929464, "uuid": "2753047d-f405-440d-9c4c-a1b29291aec3", "value": "24576:jyqC6My+zb5MCvcQTHSvUgT72OIDWJrDPJ:2qCYcbyC3Sc2IDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929464, "uuid": "f63d1dea-e1d5-41d4-a630-796ece625b79", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929464, "uuid": "68760410-2304-4f0b-8a92-afef740183a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929464, "uuid": "1278a258-1d1c-412e-917a-8bb577253d24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0d2e96-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897625, "uuid": "69d13aa6-3022-47ae-92ca-6ad068797715", "comment": "Malware payload (Mirai)", "value": "6c07cb221f5186e461d3a5ce437f6aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897625, "uuid": "d315d488-c76d-4de7-b187-6e871d2b1257", "comment": "Malware payload (Mirai)", "value": "2d3598763751657d870553cf30e634d62d7e7e92462f53a90204fcdab5769432", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897625, "uuid": "e8619176-3d30-4460-9e0a-4b9c23043224", "comment": "Malware payload (Mirai)", "value": "f4c5b0f70622d28ad8f6f544bf8ab6a7daaa6840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897625, "uuid": "1f6c864a-9d88-4244-bc58-60f0937f16e6", "comment": "Malware payload (Mirai)", "value": "3482bfbd576686f917d3cc2226a391c8c3ef0fe2d87e71ac176a21e73fae487458564b777145d7dd56146855190ee8fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897625, "uuid": "9c2c3221-9a90-4ef8-9157-c05d4e3de22f", "value": "T17393BF31C9606D90E1594E74B8A88A38A723F50443872FF69A94C37FA44BDECF1593F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897625, "uuid": "c7c0808b-931e-41bc-bd5a-3f4fcdf1b095", "value": "1536:O92PZBaJi9WUoXXtWIUfiQhXJXDAH834Z/IF4K/+vOHNHtPCjdqplZJg:OWLXWAJKQhXJXDF8/IF//6KHtPflZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897625, "uuid": "6b71e993-36cf-4d41-918f-a95e64cce1f4", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897625, "uuid": "bb872757-bbfe-481a-b3f2-4c38ab480c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897625, "uuid": "ddf8e7f8-63b2-4c47-acc2-0104dd04d8c4", "value": "6c07cb221f5186e461d3a5ce437f6aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee26f4a-0c62-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686932847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932847, "uuid": "398cfc4c-e646-4d26-9984-9aa9d4ea006f", "comment": "Malware payload", "value": "e9bbea55862120419e8c54258451b8d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932847, "uuid": "70368013-9cbd-4493-b826-5a70c8529216", "comment": "Malware payload", "value": "2d7cac2df46921a11de86b063d8fcfa63daa46067d63ff2ee0935f13c3e8dfba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932847, "uuid": "ed86cd9e-4488-42e4-baab-fcf8f559d984", "comment": "Malware payload", "value": "f268c41a9be9379e245eb4b4b9decc5027062ab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932847, "uuid": "6725a91a-4c3a-41c0-baae-10af335fab9e", "comment": "Malware payload", "value": "822d84a9f13c1968385af981b728432131f756d9e656f8401dcd756fe401d1f307e13f8e9777e936a252e54fd2269798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932847, "uuid": "e8a7ac8f-ee41-4eab-acf1-05a75d8454f6", "value": "T1D1F2E1BC021610AED9689076C3FC27D5DE3207F2A653FD8A51749BE6CE06114F4B3785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932847, "uuid": "2d1a1554-401b-4d29-8e0b-5edc9a91dd28", "value": "768:cySxPmfMApCslYjMvwddiTZhfaVDZjS7A9cJQ1JgGlzDpUYs2V:cySI09ACsudmZRaVDZjBcJQvVqY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686932847, "uuid": "6ab93a5f-c63f-4ca4-9310-adebeabab9c7", "value": 37532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686932847, "uuid": "d6df8207-3062-43de-8645-670a0b2cdbc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932847, "uuid": "e17437ea-cd5e-4e82-b667-fa4deb9b17c0", "value": "SecuriteInfo.com.Heur.20230616162810688016793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b33eae-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686914310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914310, "uuid": "fbc39c64-a790-48eb-aba5-dc57a383b680", "comment": "Malware payload (Formbook)", "value": "220160168acc5463d5ae946efc77bbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914310, "uuid": "9f3a69d3-d101-44a9-b1dc-7f11d4fc21ed", "comment": "Malware payload (Formbook)", "value": "2fdacdb36dfe8221e189f86b9ec7fbb6673a05b0b3ca396bfcf8240b0212b3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914310, "uuid": "05bac5e5-b910-4be6-adf1-1b607eab12f6", "comment": "Malware payload (Formbook)", "value": "032b3805227e8f9183a71843f2c35ca234db342c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914310, "uuid": "6cb69578-313a-487b-b8cc-9575f9df303a", "comment": "Malware payload (Formbook)", "value": "20da34acbb054beeb591a94aa81aa2ba7dc99651c23593e5bab4b6416c89402b2962b8a5de09fb3608c3d501f05d7486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914310, "uuid": "e14ba8c1-3605-47bd-9336-0b136943d622", "value": "T16A441211ABA0D0F7FC5746F22E3E27965BF5E6206165234F0B102BA93E219C0DE1E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914310, "uuid": "095ffed0-1c88-4a81-812e-f9b3b981c94b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914310, "uuid": "d246bb3c-6d6b-4033-96cc-d71ba6891cd0", "value": "6144:/Ya6LmLcy8e3kt3luOxuWb+If4T+CwBHDHI0apkRlXswm:/YhIcy8ew1lbDf++bI7mRRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914310, "uuid": "7c793f95-0353-49c4-9868-2b9f30c03536", "value": 259654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914310, "uuid": "b0dbc744-e3d7-4287-819c-7b01c86d5cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914310, "uuid": "c8d95734-35da-428a-8495-fe06e6a17824", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd7c602-0bea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686881416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881416, "uuid": "ddf6259c-dc39-4e21-9116-964ad1bfa37f", "comment": "Malware payload (STRRAT)", "value": "164230af55ddfd4874e15128ff27ac26", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881416, "uuid": "9a5b569f-d431-44e1-ba29-a50b73b5c89e", "comment": "Malware payload (STRRAT)", "value": "30a3607264bb160ac50c9c6eadb049dd83f9df01cefa99821b75f1d45b1bf49b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881416, "uuid": "cd566b32-ffd5-46f4-b8ac-a0fc8ea7314f", "comment": "Malware payload (STRRAT)", "value": "6d1b2a4913eb5bfc8257b9698140940e95b55d81", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881416, "uuid": "7b5a3f17-3c98-4922-9cd2-8a51821c098a", "comment": "Malware payload (STRRAT)", "value": "2fb3433506e1f5b8ccb49236d5ffe663b4bf47dddd109c27d559ee3df481eb46f04bb7b48fb1903e6f87c70ce811a8cd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881416, "uuid": "44048751-5afc-4d08-bfd9-b36a6981b89a", "value": "T1F924011F3AA6C0FBD50BC1B3452AE261FB3D0158A841A16F32FE1A414C75C5D8A92BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881416, "uuid": "ee147242-0404-4c45-9a89-eea4fc0cff77", "value": "6144:UPi0wB//FkdQtT4m81s84hgAgPNgNSbTJizNmRxlA:UPEk2q/4CACNgIHJizNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686881416, "uuid": "7eea2adb-2776-46aa-a42b-a376bfb05d70", "value": 223533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686881416, "uuid": "60a8c5e8-f1a7-41a1-aa7f-ef14f6e6fce4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881416, "uuid": "0fc7ef15-85da-47f8-a9b6-0e53d4709bc7", "value": "Enquiry W0280 - 16-062023.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2263d3c6-0c47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686921015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921015, "uuid": "3a11e783-fdee-4d0a-ab72-ee27b08d3331", "comment": "Malware payload (AgentTesla)", "value": "11ea013dca078f8d61d5d2881e8d2ba7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921015, "uuid": "aa031827-f3d4-4e28-860b-a9960194cc6b", "comment": "Malware payload (AgentTesla)", "value": "30d0d9777a726d380c3e477fc5fb70ecc6b7d254bd089926298ea8bb441042ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921015, "uuid": "37789f9f-0129-46c7-953d-3cc8fd344239", "comment": "Malware payload (AgentTesla)", "value": "86827f5c0e6bb04a1284ff7f7b32b784cd3337bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921015, "uuid": "545c4034-c806-4150-bebe-f58ce3f11199", "comment": "Malware payload (AgentTesla)", "value": "572b7a0704abbd4f08890c626d10151da4fc996e392665dcd3317e102ca966dfb46802f919d5ed84778e15838357d1bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921015, "uuid": "d4d3abe5-3b91-47ed-a7ea-9392a1231410", "value": "T1ADF40244A7FD8716D9BF27F8906599300BF2B4996536F35E1E4270EA2A22F214F01F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921015, "uuid": "ea33ab55-caff-4efd-83bc-8cc6d8d2b56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921015, "uuid": "09434c09-e7ed-4a1e-8337-d1d2275732ce", "value": "12288:kuRefyQriDLOdyq/AyBQyWtZRi3/Ww2u4NYr9GcOnSV4EXqXdVJl:kuY6QOPOdV/ALtZg3Hfhaa44qXdVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686921015, "uuid": "8ba12253-9430-4c5a-8deb-bab6ba1a9fc9", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686921015, "uuid": "3d6c2ce6-08a3-481f-8aad-7fb38a84bfac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921015, "uuid": "26f2b440-fd83-4a71-b1e4-f66a7c72cc7a", "value": "GOSUQNQ1041360.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72809db-0c4c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686923466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923466, "uuid": "e67cb5f9-3990-4425-a193-fef585fe1eac", "comment": "Malware payload (RemcosRAT)", "value": "393453fd344ebe07226799750ac5d9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923466, "uuid": "0e9a2c37-d39e-4514-af7f-8c72cf7060e9", "comment": "Malware payload (RemcosRAT)", "value": "314e911dd0f06cd8644ef46b7c9eae8e7ec6963f940d357a7987af27095a2cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923466, "uuid": "2b637af7-4b1b-47da-9e0c-3b5d6f90711f", "comment": "Malware payload (RemcosRAT)", "value": "9a85388a1bef45c0b932a5004e884708ed1343cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923466, "uuid": "bd63a7b2-a231-4907-97cc-b9422dd89bab", "comment": "Malware payload (RemcosRAT)", "value": "005e10793f3b73da1e1dcb6b4e02155a8283140de334124699ca61756713347b42bc04c81d7c5c84493105746ab412ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923466, "uuid": "c926b753-c596-413f-ae74-427f2b071644", "value": "T1BEB4233C7170D88BD89146B3AE3A13B61E21F5250158F23A47D1EA2FFF635D1E98A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923466, "uuid": "893de5d0-b426-450d-b62d-3e85f8209029", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923466, "uuid": "e77f2358-0f6a-4564-b09f-f8cef27de05f", "value": "12288:/YkEY66todPfbq+rUzyWXaAgo+f32RrNA:/YkG6tkfWAUS5fkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686923466, "uuid": "b6c4392c-c8ee-46bf-920f-e836346c9959", "value": 526803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686923466, "uuid": "d1f24b6c-7570-42dc-9607-d66cd2ee4178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923466, "uuid": "09f1708f-369d-4310-b36d-7221423c659d", "value": "SOA Sinotech Logistics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986261e5-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686914341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914341, "uuid": "16a33b1c-ac25-4423-94fd-64b81dfb0e4e", "comment": "Malware payload (Formbook)", "value": "b6f80ee925e9745fb5305429f1ce1a74", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914341, "uuid": "601b5ed3-9e82-4413-a896-2d56b3c0e02e", "comment": "Malware payload (Formbook)", "value": "321691557b39805530f57b29887ab32e5ddd81ad080ac4d91d964c978fbc6b04", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914341, "uuid": "35678810-66c1-4066-a060-3a429babb610", "comment": "Malware payload (Formbook)", "value": "c1d19e16638195fd2fdf8e4adabea6d1b25a8681", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914341, "uuid": "6a5bf8e2-6580-45cb-b45e-c60ba09bdcf7", "comment": "Malware payload (Formbook)", "value": "f826690d8cb69aa0aac65c66d1ead96ecd5627ed9c0a553f35400d9ea54bf3e318e701db67358c0347ab401e67f804e6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914341, "uuid": "f60e8fea-3b4d-4a5a-a4ca-8de515661422", "value": "T1DE441290FBA0DC63E4A645F92A7307366FF4A8246079176F13600B2F38663C3D54DB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914341, "uuid": "3cc2152b-a102-4c98-9591-0f7ed75c5242", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914341, "uuid": "7b0d5bb5-c3fc-46f4-a8f1-f6b200adf935", "value": "6144:/Ya6RZ7+pUU4mnLG7nwjhtwa9sIStaIR125jJvTMa2R:/YDZ7KUVmnLG7nwjZ2JaIR1UTbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914341, "uuid": "0d006e0a-ac51-4e50-9174-57ee788a3077", "value": 259649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914341, "uuid": "06d590cc-4583-4245-9a37-1419faf37cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914341, "uuid": "d78eac72-a176-499b-837c-3be9ca03f859", "value": "DHL Receipt276334VWE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253753b1-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686905987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905987, "uuid": "5aaf7d91-98b9-478f-9300-33af14fe93ea", "comment": "Malware payload (Mirai)", "value": "7c7305f9ed1f2d40825a41d16ab0e1c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905987, "uuid": "65c46858-4867-4b77-a34e-790fd1330c3b", "comment": "Malware payload (Mirai)", "value": "324ca62f502bcc94f8a7bb118be967c49ace8a62a1d1d46b9e89b5b1201fb306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905987, "uuid": "f68a1261-f9ab-4f01-9552-7a10dd57ebdc", "comment": "Malware payload (Mirai)", "value": "f394caa87b650ac9b3eb5732405c1cafa5403d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905987, "uuid": "4c2a3127-4774-4e68-a500-64a065289f5b", "comment": "Malware payload (Mirai)", "value": "b3a5a73f920be0e6f814346b87885dd90bce29969e5b4403fbca2c3592283a5b8565a830d6ff6e7fba005300086adee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905987, "uuid": "affee57e-f3c7-4814-a255-24757a6ff47b", "value": "T1B053028450AF3910D0A5CE73AC59604F3A871BF4F8FA3A3071A9553EB6D12E2D277897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905987, "uuid": "65009f0d-d9f6-4cd1-a19d-e238be061b9e", "value": "1536:VkAbkpRtdHfeYhOutyxuAL/3xPtpznlIJL8vMgdDYb9Ur:TsHFtyx5NfLlPvMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905987, "uuid": "2421fe44-fe53-4e55-bc91-59731e95917c", "value": 63236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905987, "uuid": "ccb8df54-daed-413f-ba6a-e75f45df8d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905987, "uuid": "497ce356-211c-4123-af80-7354b92ffe58", "value": "7c7305f9ed1f2d40825a41d16ab0e1c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6568f2-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903043, "uuid": "3d314694-ecc5-4203-9b4a-7066a8db95cc", "comment": "Malware payload (Mirai)", "value": "214056a6abe54eb08706f419c0bc5738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903043, "uuid": "b29f6849-e377-43fa-9bef-52c6a8062ea5", "comment": "Malware payload (Mirai)", "value": "32f09deebef50eea2685d082cfaf67f9b0e8fd8a2c2afac56e383364f7aaa657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903043, "uuid": "0a070b29-77a8-4e99-9433-329bf3ede1f3", "comment": "Malware payload (Mirai)", "value": "283a146c276ff2dedcbb389f276055bfe1d37160", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903043, "uuid": "8d682f5a-261a-43a6-91be-8d30154d0ac9", "comment": "Malware payload (Mirai)", "value": "baf8ccd89f6b04132d59b2fb0d2afe1e39a4ca564debdb16a7143da759a6a8d9cadfdb0a7c52e2a416dd727e2c6f651a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903043, "uuid": "0e704e79-5227-412e-a1ed-2192fc9c0a01", "value": "T15EA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903043, "uuid": "24659fa5-7872-48af-a7c1-25b0a843a977", "value": "3072:VK1z13U6HzHoXRtmTUhQogoEmmFVcqq0GnDZT:VK7DDeKlogoEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903043, "uuid": "c2781a51-4edf-48fb-9a2f-72fbb0022a1f", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903043, "uuid": "3bfdabf4-b964-48e9-81e5-b671d0c97173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903043, "uuid": "4afb8884-86b1-4d0a-ab0e-ff6264f96d68", "value": "214056a6abe54eb08706f419c0bc5738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7200824e-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897526, "uuid": "3955845c-e22e-409e-b2ea-c14e84c00e4f", "comment": "Malware payload (Mirai)", "value": "0dcae7332bc4b6282f09344a197a669e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897526, "uuid": "d395a2bf-013b-48bc-a933-7ed361e4f2dd", "comment": "Malware payload (Mirai)", "value": "330d888087513dece86607c91f6278026699230f066cebfb4632e6bb55636c88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897526, "uuid": "b81f3c0b-02e2-4a0e-97bb-cba04a0885b5", "comment": "Malware payload (Mirai)", "value": "6b53a10e8c3f486463388d279d762c59e9eecb1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897526, "uuid": "a40f9acc-f418-46d5-b93d-fa2882a1bc08", "comment": "Malware payload (Mirai)", "value": "9a4124ebd1e60db8e2aeb8c91974f6f0f85f02f6dc1e1fecc4e7601df29b93c54f60f6a8256412d46ce097ddd12428db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897526, "uuid": "a0a4ea3c-1a2e-40a4-a323-fad9a312928a", "value": "T1D5330173A3BA78E0C9E153B3FA316869F07A2E3C655AB14424F85A4657D29078FD0382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897526, "uuid": "946cc28a-3acf-42fd-af18-1c4cb7c59bb2", "value": "1536:d9O/GRJv3XWP8DrdUC+LcPqF1aBexo4opKZb3:d9O/0OED5mLGqFUFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897526, "uuid": "2418dacb-6f0e-443a-b9fd-5cf6d4f5af1e", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897526, "uuid": "b54969e3-3450-43d6-939c-5b7c9dc98202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897526, "uuid": "867d1bbe-5b43-4b6e-b3f3-effe50ef6f2b", "value": "0dcae7332bc4b6282f09344a197a669e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce3eb7c-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686906000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906000, "uuid": "e7e6378b-3a51-44cd-b122-c957db9170b7", "comment": "Malware payload (Mirai)", "value": "a8f38f431979e9f079a6a67d82dbf5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906000, "uuid": "98d34549-b559-48c9-bec7-6217b14d0ba1", "comment": "Malware payload (Mirai)", "value": "34177a3a626de90186d38270bea9ace2ffd8c960279a1a9691f143d5bea01b3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906000, "uuid": "96320918-568c-4a5a-ab0a-00927d1c265f", "comment": "Malware payload (Mirai)", "value": "847b6b48912d8c423d8da806b78d017bb5630689", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906000, "uuid": "3d85898c-2105-46fb-bbeb-fe01f3cf7fa5", "comment": "Malware payload (Mirai)", "value": "6f79e2a91cb10824c61fba427c453c9128f6c21de38ec87da83fb8170caefe493ef35a638f7713c371830251c545fe02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906000, "uuid": "77839d3a-ecbe-44c8-953c-b008d5f51f94", "value": "T1E903F1E455409D30C7F07CBADC6F500DD227B7FC88F969AAB2241257A68A8D743F64B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906000, "uuid": "7101e13e-77ed-469f-aff0-f432817253e9", "value": "768:26V8gxhJcKKMOX1/d0LVBN3dilqnnLWKJc63ZDmkf7tnoFdSjC5Eq3UIoe:26V8GhJcKJ214B3jLWb0cw7VoFMjC1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906000, "uuid": "fa559b53-07aa-4f4d-9410-6b2e22d50e12", "value": 41076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906000, "uuid": "d6619933-e54b-43fc-afc9-e1116b0290ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906000, "uuid": "f98e5fb3-8c76-4119-910e-ced738e8c381", "value": "a8f38f431979e9f079a6a67d82dbf5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c396d1-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897561, "uuid": "a8c62c08-1c69-4446-baff-53f0ceb1cb74", "comment": "Malware payload (Mirai)", "value": "8551b6ea1981bf80178c863cc3e54922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897561, "uuid": "7f5386ea-2e9d-4130-b112-490121f574bb", "comment": "Malware payload (Mirai)", "value": "349a92038b47191c1822c02f16cf36655bed6eeefefc05db77e5ab3ab939ba73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897561, "uuid": "250ed069-f36e-4dd6-a017-c1a87e1451c3", "comment": "Malware payload (Mirai)", "value": "0ab2d28c297fc15fadf48f50cae0a1505f7da10b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897561, "uuid": "8417e107-6bb2-4d8e-a0a3-fff3ee239647", "comment": "Malware payload (Mirai)", "value": "7293a9cf455b840743bd43852f6467e4e04de04fb05a39b059ca88400a125ce5a5b1e2291efc58f0ac0ce32dc0bdae5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897561, "uuid": "f059402f-2f81-40a3-8d56-ad52daacafae", "value": "T1E5C2E030A8DF7CF2DA904873E6B882C777850F7AF4B568A5604013B4BA4255619EDBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897561, "uuid": "648adc41-6d43-40ff-b988-52c790caf949", "value": "384:ARt/koxisa34beDtZwJoScUSEQkKOKaj1dUbn+Zzyd5YjOhKgFhymdGUop5hS:A7soTAZeoSaAdKk1dUbmuP0gFs3Uoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897561, "uuid": "bc5c1cb6-8e92-4879-8c0f-9132d9a87949", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897561, "uuid": "6e67256b-42aa-460c-b709-35226ed3f461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897561, "uuid": "d588ea44-a0cd-421d-8f8e-bea7b5543f02", "value": "8551b6ea1981bf80178c863cc3e54922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10e5cce-0c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686917362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917362, "uuid": "87653869-7813-4517-9d5a-40eb7eb280f1", "comment": "Malware payload", "value": "090e3027d7587e3e311e558d1c6b3ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917362, "uuid": "dced6c65-63bb-4268-9226-e4accdb4fede", "comment": "Malware payload", "value": "34f0569af9d7425557c8ff855a8cef2f351703db6f988739cefd47822a09efeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917362, "uuid": "5b36270c-40d6-4adb-b5bd-4db7fb92aa4a", "comment": "Malware payload", "value": "0c7b4c16dcce5639c14283681bfd1840bd637896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686917362, "uuid": "3464fde7-d60b-41de-b7ad-493ff50278c4", "comment": "Malware payload", "value": "5c9fd13533c01eca1e5f0101ae635db9e0ab89c0f77e0e29c2e49116f019792093a994625d425757b04e78756916ac25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917362, "uuid": "8c4a4721-3855-42f9-b12b-331043985793", "value": "T13EF24A00BBE84765E0D987BDA431121443B2B7776723E7681FC7A0E92A733648A55BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917362, "uuid": "57bb206d-ea28-48bb-9cc6-9602a3f04933", "value": "768:k/IVNveg6WZHt1ptrajqTRkoYIscd28UPvwbklVT1Lx:dVImN1ptrzdscdfgwbsT1Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686917362, "uuid": "ba3de529-28f3-45a7-baf3-14250753459f", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686917362, "uuid": "381182e8-744c-45fe-aa76-ccebd838050d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686917362, "uuid": "1f9f4f49-b2e8-4561-b9c3-ec1328bac85b", "value": "DS_220602K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2822eb1e-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686922743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922743, "uuid": "e25806e6-5783-48c0-a250-1c548c81f26e", "comment": "Malware payload (AgentTesla)", "value": "9aeb260fe881bda509d3398ec57909ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922743, "uuid": "023617dd-a31c-4f94-ab74-9ae801151a41", "comment": "Malware payload (AgentTesla)", "value": "3520f6322123eacd232b1dd107d892e852aa8cfa79eaf4fc3fb9c5b23893c948", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922743, "uuid": "dfba91ba-bc8f-4dcf-a54e-991044e59bc1", "comment": "Malware payload (AgentTesla)", "value": "59443b0839551bdd01d7ba7b71e889d5ebe3b1b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922743, "uuid": "9a4ef435-9eb8-4199-a558-3c4afb8b8d02", "comment": "Malware payload (AgentTesla)", "value": "6fb48481beaeeac7bb9e0bf92aafc35f8aeff3594d497e7c834e186c92ae81b7005815a25e34fc8efc0c6cbfac5b94fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922743, "uuid": "bc286f62-4eb5-41cd-8094-61a4a14068eb", "value": "T1FDD4236857A3DB27E0670BFAA450647403BB53A5782ADB170CD3B3DC6F12F932610A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922743, "uuid": "60099c95-b887-4cce-98f8-217ce2a4bc4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922743, "uuid": "7d390326-8550-496d-8bc1-e3a59854acdb", "value": "12288:N5LbzIu9+r9wxQHYgbC6S9Fk40Ty39TCJ1lOUyilxfnBYBpxN/vAuPHU8:N5LA9OQ4Xhp5NTCzlOUyij/BYlZNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922743, "uuid": "d42dc402-c7a0-44e2-bef2-d9f6f9f7d51a", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922743, "uuid": "cdfff64b-9bc9-4bfc-9f73-86116e40ca41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922743, "uuid": "1c724111-da7e-460e-b2f5-6795d8aa899b", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7022ca-0c28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686908063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908063, "uuid": "0c73478c-e37f-48a7-8285-d92670a60ac4", "comment": "Malware payload (QuasarRAT)", "value": "3d05c749ca0294f33e408903aa27641c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908063, "uuid": "82fe316a-c25d-49a1-bdd7-0524e740c6ab", "comment": "Malware payload (QuasarRAT)", "value": "36c483343398ea17347a4be4360ad4fb5f693b71cb61a5ecd919058a42884a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908063, "uuid": "7dc5e1e1-7b2f-4bd0-8ea5-9d7bc31f8401", "comment": "Malware payload (QuasarRAT)", "value": "9205b95e8de89f2bb4416dc901b2ffbe7aad7d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908063, "uuid": "ac8679f5-2f07-402a-9cdf-eb6bba2f0e23", "comment": "Malware payload (QuasarRAT)", "value": "8da4579da6624298fe23a73fc85b258a77e56ce3a8755184919b017d2a6ccf1028d5e2686e1842b30ed3c914b2df2d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908063, "uuid": "551906ef-359e-44ab-bcb3-432f822d3e03", "value": "T1F1748D1377A4ED3BD1BD2B3AE43206050BB4E447B716E38B5A6855B96C133878E817B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908063, "uuid": "c17c6111-07e5-4875-ab8f-51d0006a3c40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908063, "uuid": "b494baed-f09c-45fa-a9b7-56369196630b", "value": "6144:52NHXf500MKlzsecP8hxQwbkm/+7E4M4LMtfwKqe:4d50KzmPZ6S7MkVKqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908063, "uuid": "4230a727-9462-4c9b-8cf4-37d63365824b", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908063, "uuid": "7a5cfe11-1242-4b84-b012-69e8e074f6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908063, "uuid": "4bff2e5b-1d31-41f3-b524-5d059f821b46", "value": "xXWWh0ll6koc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c21eca-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900665, "uuid": "f6fbfee1-e475-4117-af0f-75ccf7128e55", "comment": "Malware payload (Mirai)", "value": "9069736b1556c88449d5c1d0025d36aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900665, "uuid": "dcaadb42-ec07-42b3-87c0-70aaf24e00c6", "comment": "Malware payload (Mirai)", "value": "36e0fb52b11e584a27f8414c86fc976ac29717a33941027b7128530c75654cf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900665, "uuid": "89f21a19-c678-4caa-9b7f-8c73118da861", "comment": "Malware payload (Mirai)", "value": "6f7b097ac3601b3303f32c2f8475004caae51af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900665, "uuid": "c64683dc-dc71-48e3-9904-b7dfc961dd1c", "comment": "Malware payload (Mirai)", "value": "d02ecee817f6068736a56d55916184acbc68b89fe35847b484a43d578188adc60a74b4fd701d5ab36dad937092efce5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900665, "uuid": "393f1d7c-ab68-4712-8a11-0446a1fcd307", "value": "T19303F261D37884B2CBB05A36C6FD8187236B67DE9BF9B04B03851528CDC68315D25A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900665, "uuid": "612afc93-8cb8-4f25-9654-58f6d86d2a27", "value": "768:vnk5aXzbzTObs2wCxFlhdsA0pJZXoiMdOH7kvcmY0QgW4s73U0:vkaLTOw/CxRdd0qwHw0R0Q94q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900665, "uuid": "5e69ceb0-2cf5-4f41-a7f4-c02dacfe21f9", "value": 39072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900665, "uuid": "329da51d-c926-4a90-bac8-531ae994e3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900665, "uuid": "f2224ff1-05ab-48fe-a754-d51fb90f8ca9", "value": "9069736b1556c88449d5c1d0025d36aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea03e98-0c64-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686933491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686933491, "uuid": "ac43cf53-5f8f-404e-aab9-be262ea9aca4", "comment": "Malware payload (DCRat)", "value": "f14935119fd0d3b31da37aea2b1f7494", "object_relation": "md5", "Tag": [ { "name": "Allin1", "colour": "#60F0E1", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686933491, "uuid": "ab641511-42c0-4c02-99d8-84f3624e428c", "comment": "Malware payload (DCRat)", "value": "3749270a04658da7d3d5b80d333b052ea91237e68b807bbe27f612d31ce425f5", "object_relation": "sha256", "Tag": [ { "name": "Allin1", "colour": "#60F0E1", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686933491, "uuid": "ab161323-eb54-4d1b-9e8d-15c8479fa4fc", "comment": "Malware payload (DCRat)", "value": "bb64f81fe895a8a86e375ac95adc564cc3e1130d", "object_relation": "sha1", "Tag": [ { "name": "Allin1", "colour": "#60F0E1", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686933491, "uuid": "ce42dde5-ed39-4dda-b566-87af7c8d0042", "comment": "Malware payload (DCRat)", "value": "0fd7b28d009dde1894265c6d0812a45b893207bca1c40c71c1cd8a911da47d2df556c5cdd9fb1e6c9db223786f32d9c9", "object_relation": "sha3-384", "Tag": [ { "name": "Allin1", "colour": "#60F0E1", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Venom", "colour": "#7A1CA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686933491, "uuid": "1c9785d7-51a6-4d09-a618-da0c6163f397", "value": "T1A7535B0037A8C965E2AE47B8BCB3550106F1D2772112DA1E7CC810DB6BAFFC656526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686933491, "uuid": "13f49bfd-c928-4ac2-8bab-d73fa49c9eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686933491, "uuid": "53edff45-bc48-4214-a841-85e1c1ff85d6", "value": "768:Cmxvn0zXf78NwC8A+XU2azcBRL5JTk1+T4KSBGHmDbD/ph0oX02ALsSusdpqKYhg:LQXDLdSJYUbdh902AfusdpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686933491, "uuid": "ec8c2aeb-d5c6-46b2-9bbf-685c30a2db25", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686933491, "uuid": "fe7dc887-c410-4a35-adcf-d8d917691abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686933491, "uuid": "661b1d0f-35a9-4d98-8361-0856c822efad", "value": "VenomRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4818f1b6-0c12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686898315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898315, "uuid": "78105c3d-cbe3-4031-aee5-e5288d303883", "comment": "Malware payload (Mirai)", "value": "91a8fb0d8320005e033cfd0b6ca2d320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898315, "uuid": "cb264b73-d264-4a3b-a7c6-1d67f3152c68", "comment": "Malware payload (Mirai)", "value": "378fd0f3e2781b111a158692be2cbec08482022802a7e0c2be25c7e62150622a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898315, "uuid": "dd7a49ca-2041-48ee-af21-1ccfd584a694", "comment": "Malware payload (Mirai)", "value": "11c9aed96bd51aec6fbb48229a63d4ebb35145ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898315, "uuid": "42836335-f992-4d21-9566-1ff06c1c3a17", "comment": "Malware payload (Mirai)", "value": "84a942b5b04ef362f7b33e456b90a5916d65bf74825931525f9593b6b42276a59c97566003ee8d604df23e3ef59c91a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898315, "uuid": "21d1ef32-ea32-4203-9bb8-4734b99ee084", "value": "T182535BC9A593E9F4EC111A71317AAF338A73E13E3015EA83D3A8A573FD51642E10729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898315, "uuid": "795db3e5-cb70-4a6f-88b6-3ed290f5d114", "value": "1536:Qa2gpfCCeK74vc1KOm5lgMnxiKze8eN+vfyv6DVsS/4Qj5hYoLz5xqOE5tS7K6:mgpfCCeK74vcI5lgMnxiKze8eN+vfyvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686898315, "uuid": "4f16722d-3ac1-4738-a41a-f2f3cbb30855", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686898315, "uuid": "8788c2ef-3b52-46f0-aafa-8e2566d3896b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898315, "uuid": "1d293bab-47d4-4504-848a-a60d900069a1", "value": "meerkat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eafd7b-0c3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686916219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916219, "uuid": "a1b3410e-8ae5-4dc8-90c0-3a4adc34f8a9", "comment": "Malware payload (GCleaner)", "value": "0513bd85a4a858a669cd935863cc4f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916219, "uuid": "eb5b6ca5-52ae-4926-b095-e9933963a063", "comment": "Malware payload (GCleaner)", "value": "37e3ff09b42c8e55212a1749dbe78b83bbb2cdeb2ce3e4250ab95695e2ed66b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916219, "uuid": "5ab2622a-b860-41c8-a8d7-a9dfa627d4be", "comment": "Malware payload (GCleaner)", "value": "a47ec60e66586aa70bc75b9b91a26eac33683e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916219, "uuid": "ec622af6-0f2e-4cf4-b07b-67857c546077", "comment": "Malware payload (GCleaner)", "value": "a728f4a2a69b2a4e6bf74348c7b60932a7c7b152e35e5519926089ac7b7a7bb4062d889013c36ea6ce7ec17cf7fe6ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916219, "uuid": "030a19f6-ba69-4f1b-bb8a-1740d1b6d8e5", "value": "T1B4C53381DBC440B5FC159B72343BAE25BE5B7D7BA03840E8715D342A2FBB5920D63A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916219, "uuid": "82030087-28aa-48a3-b78d-dbcff9c8652b", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916219, "uuid": "e9da2b18-6f6f-4372-8ccb-a8e64438c977", "value": "49152:U6de6YG8oOK9/hwtEsx4mbuiL3CLWXlLy244GLVtBqh00waZky9WdchanwDOZ:jde/YOaZw6YZdLSSFyPWe0w4L0SDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916219, "uuid": "f21ed5a0-fa21-4560-938d-af23522aeb83", "value": 2627567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916219, "uuid": "26e745f5-7951-46f0-883b-73fa0641b5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916219, "uuid": "8f4af03d-38b2-4c54-8620-ca93d3bf0c4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f505cb-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937025, "uuid": "53165fd2-0e1a-430a-b508-d7c119f68113", "comment": "Malware payload (Mirai)", "value": "bfd1e2596dae4cc2d2c210a72ad19831", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937025, "uuid": "ad4e8497-c225-455b-a4ad-58be23cb7770", "comment": "Malware payload (Mirai)", "value": "37f412cd6da7842c215c51e445d429465326266e6ee56f306c1865fd2fdbde1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937025, "uuid": "db873f43-ec11-425b-8bc4-f38959d0928f", "comment": "Malware payload (Mirai)", "value": "63b03e204fd69e4819e262a43b17130dff467dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937025, "uuid": "c930cf41-077d-45b9-8810-439aa30867f8", "comment": "Malware payload (Mirai)", "value": "371207046157ceb307b755e5819a4ec65e798c9324257ad55ac633d7e5256fa4b45060bd063def78e14ad442062c0a64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937025, "uuid": "16995dce-affd-4085-ae83-f6adba91e32e", "value": "T101E2F1A7D3719052DE746BF1E9A984CA5BFC4A6CC53B30A31A05671C2A5B0435F3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937025, "uuid": "0301aae8-0c31-474e-bf05-c7b9e81d5ba3", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XuCk9q3UEL5Iq:1orm1vpALgUJuULV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937025, "uuid": "2aae9358-9531-419b-8389-f4f46f480d6f", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937025, "uuid": "b9da09a1-3cf1-462f-892b-8dc796ae4018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937025, "uuid": "5b0f85dc-9f4e-4882-8241-a27d85cc1d91", "value": "bfd1e2596dae4cc2d2c210a72ad19831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e65fb2-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937048, "uuid": "f350e211-7b1f-494d-8461-f87d508fd3cc", "comment": "Malware payload (Mirai)", "value": "993bb94c793ac5a19eddd658b6f88518", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937048, "uuid": "e2cab254-964a-4316-93cb-ddadfde48a4e", "comment": "Malware payload (Mirai)", "value": "3824bc6ca95a9b9ee90ba2de76e2d961fa1845a2bdb51b189c89674740f86328", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937048, "uuid": "717361a4-3108-478d-9b41-8b8c79293b5f", "comment": "Malware payload (Mirai)", "value": "3c518d40f70295d3c407dd786993faa748366c36", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937048, "uuid": "1ea7f625-f25b-4ab7-b29c-e0f689b988e2", "comment": "Malware payload (Mirai)", "value": "7449da05a0baecce74f9840312fa9ed0ff73fcfd38652973650e72d2826d09ced32ba5b321fa40ca1d43788e9c841cee", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937048, "uuid": "3eaf8665-7d95-4b3d-b58b-bbb05aa66ae5", "value": "T11ED2E0F7E1FBA2F4E4F2B871385ADD40F5A531678718535A01BEAE85DBA734C6030912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937048, "uuid": "d1a9e46b-2346-42fa-bcfc-f92c02c7cd40", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2XJlSx0sR:NYJdJZuCj+CiE7L1APbaJwtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937048, "uuid": "d1bd8315-b6bc-4fd2-bf74-b598488aa0cf", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937048, "uuid": "eed5cd4b-4485-4f3d-9c9e-0faab8a6861f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937048, "uuid": "f92ee1d0-1e10-4a1e-a95b-1ccdfff3cb23", "value": "993bb94c793ac5a19eddd658b6f88518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eada91-0c5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686929685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929685, "uuid": "4351b18e-48c5-4a2d-9fc4-f1cd7be34299", "comment": "Malware payload (DCRat)", "value": "2ee68491f46362e5bbb537821e5fada9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929685, "uuid": "32e9e65d-f5e8-4409-8791-f002e1f0288f", "comment": "Malware payload (DCRat)", "value": "398bf921701c72139dfa6d11b2eb41810170eaf847cc73f16ff00c8f86d6d30a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929685, "uuid": "228559b6-9aa5-48af-bfed-e4cc311159ed", "comment": "Malware payload (DCRat)", "value": "10d700a72c706c7479ea1f68be282d5f13843183", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929685, "uuid": "6706e135-4da3-46c6-83c1-c13a88070676", "comment": "Malware payload (DCRat)", "value": "1acf7aec9cad1a4267e8b3bf220a33443f33b16b88a34578a2f98d719fe3e3076aa9141e62b3f629c4eb03a4a445ce6e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929685, "uuid": "8a9a63ba-63a4-4f83-94a6-fa5a994f030f", "value": "T1E3235C4037D88136F2BD4BB8A9F2E54582B5E2572D03CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929685, "uuid": "94643339-f235-4e80-8d4f-dfd15ac41dd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929685, "uuid": "d81f1e1a-0128-4cb5-a3c4-aaa95b721541", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08Ybyge3ug8+qvvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1wx0vnkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929685, "uuid": "3f5e5544-4653-4449-a10e-6bfaeb1a1227", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929685, "uuid": "10a4ae5c-611d-429e-9ad3-d07a8ddf2396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929685, "uuid": "11d9b942-d891-4795-8687-f8f723d614fa", "value": "xjynAgWeyfUG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305eb674-0c27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686907294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907294, "uuid": "5bdcd0b6-3f15-4e27-a3f6-607bf923c107", "comment": "Malware payload (STRRAT)", "value": "0fe380592f9947989b2ffeeab2fbd17a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907294, "uuid": "bce1ef8b-77b5-4deb-b052-349a0717b81b", "comment": "Malware payload (STRRAT)", "value": "39a48245cc13aec054c2b91204149f20e194e6158fdfc18519acc5decb50148a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907294, "uuid": "a8fcfad6-3a0c-4118-83b0-1ada93c56c6c", "comment": "Malware payload (STRRAT)", "value": "8457cb303fd5fae8b78b9bda550c5e9b10289f03", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907294, "uuid": "e0d6df24-db23-426a-8539-23d775dd42ce", "comment": "Malware payload (STRRAT)", "value": "5e19b83f404c299b11bf22e4e9140b9af87e16f6e5b6bf3e27ed304531e873acdd4d265f1f7bd9200ace40e508db3069", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907294, "uuid": "66f304b3-2c76-47ca-81b5-19f18f1564ca", "value": "T17F45F10DBDDBC6E8D51768B204187A219B0D81B5D146D97B33FD06698FF4C6A1B03E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907294, "uuid": "b6767489-c762-4913-b26a-c12b2eaf8a3b", "value": "6144:TdRPN78WXHNZ7OX2cg5znzn2Ma922gt4QYtQ90Y22ss:TTVAWXH7Q45PnrcXgt1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907294, "uuid": "145d7686-f803-4121-a1bb-bfc35c0667b9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907294, "uuid": "b84e1d90-83e2-4006-bf9c-296fda7e2023", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907294, "uuid": "d2afd3ba-c9a7-4b1d-a5d7-178ffc0cc963", "value": "Enquiry_06-162023.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5509a9c-0c38-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914819, "uuid": "a3872524-f413-4224-b37d-5008e002c9e0", "comment": "Malware payload (AgentTesla)", "value": "6402f3dc5dfc34f719837e1611b144c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914819, "uuid": "62bd7d43-d0ea-480a-90e5-a7dd19b67f39", "comment": "Malware payload (AgentTesla)", "value": "3a736b576c9acb60defc9fc65fdf2c20677df07068b805bcb1da3e05aeae72ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914819, "uuid": "f99df265-2992-4861-a6b5-7e4a8fa26dc9", "comment": "Malware payload (AgentTesla)", "value": "7bdbb138bb2ec9a4a7e90b8e1ce564db0358157f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914819, "uuid": "7b8d1c7c-cda3-42ab-92be-56df760104b3", "comment": "Malware payload (AgentTesla)", "value": "bd8c0fa1fa5e57845b9bf5a8f55022a94eeaa5933998b266fd72dd2c6b2f3514f657378eb2d883c25acae35f0d92bcae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914819, "uuid": "fff7de69-2efb-40c6-aac6-2ed44556d583", "value": "T1E505D014337B5F25C8396BFA48506A3497F8AA1A783FD24B5ED2B4CAAD50F104E80F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914819, "uuid": "c0705f25-8cce-4db6-ad18-ed2c29dfd452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914819, "uuid": "e8173717-eac1-44bb-994d-4ae69f75ffa8", "value": "12288:bHrRlhaDnLMzIL2q+RTdOL8kaRgEbfcPm+6B/2aB69J/9d0XPbwV2TBHihM+eI:bNOyqGUL8FLIPmvITbUPbo21CML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914819, "uuid": "a945acb4-5448-4232-9107-ccb6c079abcf", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914819, "uuid": "c4a41046-fb4d-4276-aa75-221a88b29e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914819, "uuid": "6dd6d76b-5553-4a12-81ae-56abbf80466e", "value": "07623.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4218775-0c12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686898496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898496, "uuid": "67cbab35-763a-4ee4-8f5e-20ed824faf87", "comment": "Malware payload (Mirai)", "value": "246b04109c8d98a5e692b3a86745ac75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898496, "uuid": "7dc6cf44-a1de-4b00-baa2-8b0554851792", "comment": "Malware payload (Mirai)", "value": "3c2a40462529e5e2de607576b2fe91ef0690f9eb86560d51eb777cf34db91983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898496, "uuid": "9bd6c32b-a29f-4ff1-bec4-ad63602a6b9c", "comment": "Malware payload (Mirai)", "value": "c9d1918a3881eaf16ca9be7c6036c9dc603ae1cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898496, "uuid": "70b5d375-731d-46ec-8816-3b2a9fe52cf3", "comment": "Malware payload (Mirai)", "value": "74c54c6108ab53ef5c514aabe25a8d350d52c6175921a6dd2a78c8a823c75701e72ba9e1d4ce88bc6e3eb8f1d432715a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898496, "uuid": "49a5e275-4dfa-49bb-a9b6-b6a36bb06fe8", "value": "T19603E147998BCBA9F836687838DFB94505D1DF0EE049F3EB6BC062BB5507FA02904917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898496, "uuid": "67f25919-98c6-469e-b688-d054fca5ff88", "value": "768:r7lULY609saLpZb3iVGJ/wzHN38SnQ1wa5L1XgQy3IItoTInZCnbcuyD7UiyqV:r7iLY67+R3iVGJ/wTt8EQ1tL1XRy3xos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686898496, "uuid": "186e6112-839b-410b-bcfd-8cb145755c2f", "value": 39348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686898496, "uuid": "735b9deb-d919-46ef-95b8-1e7ec1c02a93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898496, "uuid": "97519567-af55-4660-9e26-9dcfa81238cc", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57df7065-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686914233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914233, "uuid": "b60fa42d-0863-4b2b-862a-98c13c4479eb", "comment": "Malware payload (RemcosRAT)", "value": "e66c2dff7d1411d1e88d1dda83d4dbc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914233, "uuid": "bd6e4247-9cd5-4135-81c3-4aaa943b7b0d", "comment": "Malware payload (RemcosRAT)", "value": "3c2b603e5f2c4bf67f3e240cff2daa7ffca9703ce808e9893f446963ff72eb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914233, "uuid": "2e0f49cf-e7f4-4aed-adf6-346bab4b4647", "comment": "Malware payload (RemcosRAT)", "value": "46972de0bd624f68a2091e0922b0749c7bf31574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914233, "uuid": "329c66d4-b427-43c7-bf54-faeb8ba4fe96", "comment": "Malware payload (RemcosRAT)", "value": "baf072ec1b7d8b28487551aed7ada1504c965563f3ece7fd9c4e7330f8c21849db8df0f7fd96ad17fc45b77c217eb4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914233, "uuid": "17d7cfe2-1c06-4130-8477-8c5304618b94", "value": "T19E35121076A8CB2BC07F0BF585001130877B526BB567D71A0DD6B5EA6CC6B8352AF78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914233, "uuid": "d74371c7-7e72-4ae2-83e5-f2f58fa9f854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914233, "uuid": "258fed7c-4176-4a3c-8f1d-270c24791473", "value": "24576:6Xa1j5LA9szjGS0iDRFdkAS69HW47mtYh4P:h95LAOzjttrj9HW2mtYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914233, "uuid": "7df7eded-18ca-4d36-9d39-0758eb01656c", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914233, "uuid": "cb8e2bf7-b960-49b4-bcb2-df570aa9165f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914233, "uuid": "b8f98645-20ac-426e-9d10-94a352da17a5", "value": "DOCUMENTS AWB 298892800828289.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d9b6f2-0c54-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686926930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926930, "uuid": "40aa4209-7c7d-42d9-ab0a-0d9ef30f232e", "comment": "Malware payload (RemcosRAT)", "value": "711d7f3622d3241c0be7356ffc744031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926930, "uuid": "6086d616-d46b-44e1-8a68-0240ef528d23", "comment": "Malware payload (RemcosRAT)", "value": "3c899f264853618f43cba770d725d45da11c04be7ac2bfb8ec387c436fa9c254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926930, "uuid": "302beb5a-6f8c-4179-83fd-58a82d689d0b", "comment": "Malware payload (RemcosRAT)", "value": "3a373cd2d686004b81e3cc20f767ef7c629d54d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926930, "uuid": "11390801-267a-4505-a2e5-684f26e3026b", "comment": "Malware payload (RemcosRAT)", "value": "f8c4a9451f9e57f7983cc044223f2ddbf87636cd09f6e18d6c2e94dce4e6ad170c9b6a6d140d5f16949f815fff6da909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926930, "uuid": "88411e32-fb10-4f6d-b18b-22ac11497fc4", "value": "T12F9412816675C877F4BA8A30C8BF9AF619789E56E490A68B27403F4C7D37BC0C61D391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926930, "uuid": "c131a61f-1eb4-427e-89a9-18f0a9e6ed68", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926930, "uuid": "e8b991d1-5cde-400a-9669-3829180958c1", "value": "12288:S0+FrXbGM2i28hs/sfl1Z3AThmbVYjVgusIo:S0YraPL/sV3AThmheVgtIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686926930, "uuid": "eca01bc8-aca2-4701-8f95-82ca81798732", "value": 413712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686926930, "uuid": "43915285-41ab-4775-993a-b180b8228426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926930, "uuid": "11207c88-3abb-4fab-aecd-29bd5ae4af86", "value": "Anam Abid. CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a316b4-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897633, "uuid": "d23622e0-1d68-4038-9e38-9ceff53336d7", "comment": "Malware payload (Mirai)", "value": "6a7733ee04b17650b2ee91ff60dd5689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897633, "uuid": "e57ad699-d16d-411f-a91c-e41e930536c8", "comment": "Malware payload (Mirai)", "value": "3f2cf1cf8df33de1ccbc8756145294f6dd974463fddc1f9f0be94028e74a54ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897633, "uuid": "d89ec6f2-a6ac-4333-8c16-37d1e9b9d8fb", "comment": "Malware payload (Mirai)", "value": "4d873ad2f7f92b59182054ad161008d8b26a642f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897633, "uuid": "9203798f-738b-495b-83e0-3c2c652ca31b", "comment": "Malware payload (Mirai)", "value": "1acdb8b8b6d77412896f2cd00e423853285e62c546075f715255215b7d2e9547c7d80abbc74b63eb996ebe06bbed24a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897633, "uuid": "d3c516e3-7037-45c2-b678-5f55d4f1d265", "value": "T1FBE2E038A1CAC6C7E72012F5F85548CB3F798ABCE57871E2961043546BC1D8B5BB91E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897633, "uuid": "9e54daae-0de8-4b2b-bea9-bebd36ded298", "value": "768:3oiWiO031vF7n4k3FRl/MsyId51nc83FCDvuz49q3UEL5I4l:3orm1vF773/ye51n4uFLTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897633, "uuid": "eb2f07f5-54c2-402f-8233-3d44df143e38", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897633, "uuid": "ff49812d-a597-438e-87d9-60fb50adacba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897633, "uuid": "e299f04a-d32b-4c77-b2b5-867f067bb4d6", "value": "6a7733ee04b17650b2ee91ff60dd5689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e991c70-0c3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686916257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916257, "uuid": "b0846ec3-9681-4c23-b584-c15ceb18a0d2", "comment": "Malware payload (Formbook)", "value": "7082705d49292c6a598576e4d7158b71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916257, "uuid": "f33f1cf7-4163-4747-985e-9ab0b53ce1e9", "comment": "Malware payload (Formbook)", "value": "3f5edf6f921e14f2640763e7178c2646a2131df0f8f447ae59100f3110939d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916257, "uuid": "37b7fb7e-9f90-436e-b426-adc390cca076", "comment": "Malware payload (Formbook)", "value": "7060e487242ac97083f4b93e44c8029ce0e35c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916257, "uuid": "c525bfda-8559-42a5-ad90-7f6be0abdc7d", "comment": "Malware payload (Formbook)", "value": "7b52c2ee0a4ea1ecc86ac51f6e041cd940275ca8db8f7e2000ecde2e476b575e335b1986cc89820d19e2e7ddf7c8843a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916257, "uuid": "abc99d02-a557-4715-a1fe-a89e66dfd544", "value": "T161050241A86A1B67D236B3F94F1072B133FE5FC92955F38B0E96F0DA9860F491A01E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916257, "uuid": "9156f919-14f7-462a-b21f-767b06a6762d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916257, "uuid": "fd1c7225-5b64-472d-a968-536c4603fe6c", "value": "12288:NucvG73htU7/2eQ1x9HshZ57x7ixWvDxDKUmo+bpafhNzdVZupH:ggG1tCuei1shj70xW4loUCdTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916257, "uuid": "ec4bea9a-9a54-4fe7-9e2d-d315cece1c66", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916257, "uuid": "8776b3dd-cce6-438d-85a4-b099f0f580d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916257, "uuid": "efb49ab3-33ba-4b37-b2c8-a8e08a70830a", "value": "Order (AONE1728-2023).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c2b947-0c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686905315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905315, "uuid": "0e2d81b0-d400-4817-b2fb-4a89d7f139df", "comment": "Malware payload (RedLineStealer)", "value": "6619db7de030dc03dfe4eb43bc694de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905315, "uuid": "f27f6ed0-fae0-47cd-9398-925304d8dcf3", "comment": "Malware payload (RedLineStealer)", "value": "3f8ae63c5897989f2f6f52b281033221eb43cc3a24ec21de538ae75e98a9a50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905315, "uuid": "fdae921e-9caa-4b01-957a-0664de923d09", "comment": "Malware payload (RedLineStealer)", "value": "099f596965cccf09a46eb1482800807c2b64585f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905315, "uuid": "7d5c7e21-99a5-4854-98c3-b862c69ee435", "comment": "Malware payload (RedLineStealer)", "value": "96f87c3809f44e88518a2680ae21bc8f686e7f4d8951fd98f2542fff7c8ee24c20cc270efd24213a42a4b596ab535319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905315, "uuid": "ff3da63a-f75d-42c2-94e8-d436abb72cb7", "value": "T12AA44B0362E1BD50EE665B728F2FD6EC7A1EF250CE49376922199B1F05B12B2D163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905315, "uuid": "8f8a8d82-521a-4ca4-be35-2bcd80fb83ac", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905315, "uuid": "3f7e62a1-6ec0-4f1f-813e-fdd4a4c815dc", "value": "6144:Iw3jCKChY8o2HysyGYOw1C2YIYuOl5OWTp21GaC15l:feKCjyGZw1C2HlOl3KTC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905315, "uuid": "c64d6e2f-ecd4-4796-8bd8-1202f62097bb", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905315, "uuid": "a295a8a1-7bf6-491c-8cf1-fcf328e2491d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905315, "uuid": "b3ed6a8e-42da-42ca-a4de-ec725dd8550c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7708315c-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686914285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914285, "uuid": "39322446-3e90-4888-8f79-236de91c15d6", "comment": "Malware payload (Amadey)", "value": "7d28025eb395781cd159f4ec42687aa5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914285, "uuid": "1adc3950-8057-4f33-ae28-4bd1a8a50ce8", "comment": "Malware payload (Amadey)", "value": "41449d55044200b89e309a0896752795e90b32b6b514a70273e64298d336b52c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914285, "uuid": "ebbb6ef0-54e5-43db-9fb9-c97e9e8777a2", "comment": "Malware payload (Amadey)", "value": "9ff5785ed9ed8e2f2592ea752f0e818ec8997310", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914285, "uuid": "90b098ac-6627-40ac-8842-b5e49cfd61e7", "comment": "Malware payload (Amadey)", "value": "1722d650964ca1d6ddac530ed4242b55dbad273adee2a6c457de24c511a50f5484d40d39aa098bcb4af62130ea93c4c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914285, "uuid": "ec80edf5-3de0-48e0-8850-d06971d27d4f", "value": "T1BBF42253ABE88032D9B517704CF647C31A31BDE18E79835B3389999E18B2254E5B336F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914285, "uuid": "b560ea1a-9c28-4cbb-a08d-0451ba024ed1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914285, "uuid": "e8b92f5d-e12f-46ff-b60d-9143cd447979", "value": "12288:jMrSy90t51EatmAzcWoKk7lE9I2Ca64f6vXf8Dq45cctdDrmrWh:VysW4qDlE9Iv1b8DqIccbqCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914285, "uuid": "a12ade87-d718-4bc6-8feb-7b6eed4151da", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914285, "uuid": "4590e31a-cdc7-46ca-b7a5-5e5746d2de40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914285, "uuid": "a14c3607-be31-4bb4-bb62-f6f040f6d3f4", "value": "7d28025eb395781cd159f4ec42687aa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436065c5-0c44-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686919782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919782, "uuid": "1faf9484-1872-4201-bca1-970ee9adfc26", "comment": "Malware payload", "value": "408a6993541d0ea2ccff4a3f76142a11", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919782, "uuid": "79071a20-d582-431e-9d24-6f36c3da1ece", "comment": "Malware payload", "value": "4244ddb0b4b4447254a099acc972f003f59fed998528f6d2a24d80f2c155575d", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919782, "uuid": "78878e3b-9976-4365-adf7-9ab9a1171c70", "comment": "Malware payload", "value": "c6a8c105e95a2ad9d2d3ee440b6bd84bf1845acd", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919782, "uuid": "97ab454c-b033-4b06-aa55-fde328454eda", "comment": "Malware payload", "value": "52e727238e5f1664f4644f19db4e3924437e8bf9eb55224b3cdd8573ca5e0d131c8c867a67945d965bc8e79ab1851314", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919782, "uuid": "1d701350-3f67-4f35-95da-8bf2fe3d4f0b", "value": "T1D123313E2C9A603BAEB2DA51C9D46877FB5A626B350E6C4950C3830644D7543BBC07EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919782, "uuid": "eff4c125-2220-441d-8622-e482a01eee3b", "value": "768:g8msKJeU9g8msKJeU9F8msKJeU938msKJeU9/iP8msKJeU9x8msKJeU9O8msKJe5:gVJMVJZVJrVJePVJ9VJ6VJ9VJEpVJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686919782, "uuid": "b9e4669a-6208-4a98-9bb7-0be9f7694afd", "value": 49280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686919782, "uuid": "50740789-615c-4b71-a67e-65151e9928ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919782, "uuid": "fe42f7e5-4280-4b71-94c6-66e6e8a715b1", "value": "rheg.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b57c11-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900673, "uuid": "927cbe99-0579-47a8-b3d4-3f50b5f36afc", "comment": "Malware payload (Mirai)", "value": "1dc7214c59f9f923904efd4775484207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900673, "uuid": "67942380-82e1-4c09-a046-3134160d7ff2", "comment": "Malware payload (Mirai)", "value": "429030c92e8bfbb974556721423b1c8396e09ad09f93eb4555ba12d19be6fb59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900673, "uuid": "79d2562d-d595-4c44-a019-05d33e6d40fd", "comment": "Malware payload (Mirai)", "value": "ea65e4f17a832146dab82ef380daac0e2214f39e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900673, "uuid": "10658acd-779f-4026-846e-f7ac276577f0", "comment": "Malware payload (Mirai)", "value": "bc4c59816b574b6051d174f942f21b1eed8a2d8ef5d9f010da6bce3603811712f98e9123407d1e6b95e7cc976c5a2139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900673, "uuid": "419b4d5b-741a-4123-9682-f3a8aed0308a", "value": "T1B0D2D0AEF2D1AD13DFAD087BA5CC57A351D4D0C12B874F9783264CC1B21698D748D4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900673, "uuid": "58bea0ef-8527-4a2d-b377-d603e7f39819", "value": "768:EldepmAcKmZQj0HsWBTreFmXZcrH5EBk9YWs:M0PcZQj03BT/Zcrly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900673, "uuid": "f6b7e935-0d86-4c30-8a98-8958e3a47af0", "value": 29936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900673, "uuid": "48232386-1943-436e-8192-9cc4d8d617fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900673, "uuid": "52fcd34b-9c5e-4cce-a8fb-809f402f617e", "value": "1dc7214c59f9f923904efd4775484207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bb935b-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686876559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876559, "uuid": "83f3eebc-e747-432b-8408-de17958e79cd", "comment": "Malware payload (ArkeiStealer)", "value": "edbfb334ec15187e55844f36a916a0e3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876559, "uuid": "07259f9a-e0c3-4415-b909-a4ca5a104e88", "comment": "Malware payload (ArkeiStealer)", "value": "42c8c439618026e2a94e526c32bc6fbe680f638a3e2b3442201725739d921eac", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876559, "uuid": "3715375d-38d3-49a7-b5c2-08f983b2e23a", "comment": "Malware payload (ArkeiStealer)", "value": "63180725c06e2f1ee0d508cb346e717936ca7992", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876559, "uuid": "1f481161-a69a-4326-a504-d609e4c3439d", "comment": "Malware payload (ArkeiStealer)", "value": "61107f875fe1afbb0e77b165efe540551073ff7b972037ae4e07eeeeb4591bbbc2976851384720d8b73be8f5324f36fe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876559, "uuid": "4595548a-b999-4b24-acec-b48ebe7d414c", "value": "T19974D012FEE0AC63D6268A724D79C6E43B1DF9518E28675B2218FB1F09711B0D57233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876559, "uuid": "01749f59-01cf-46dc-8d73-85733a49f2f8", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876559, "uuid": "b417a548-e9c1-40f4-a39b-78b0d2b850a5", "value": "6144:82+8hyIZ3E0AywrE84vobvhJB/Rgev9RXTCHjz4HZ0ojoH:82Fhyo0VKGJvyALiz4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876559, "uuid": "2588054b-49a5-4896-bc5f-5033d06d9b48", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876559, "uuid": "8b558dc9-92fc-4d23-aaf8-5d78275b8c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876559, "uuid": "3ea1c00c-c674-4cf3-930e-6f632e1aa899", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d277fb28-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686876643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876643, "uuid": "ff139bd7-6ee5-466a-b046-9eae9225ca2c", "comment": "Malware payload (Stop)", "value": "330a396ba665a3dd954984ec87d39ecd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876643, "uuid": "e23419fe-1d02-4297-bb67-4b7671f32331", "comment": "Malware payload (Stop)", "value": "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876643, "uuid": "01ad91b3-2373-4283-9b3a-8b7013fd7761", "comment": "Malware payload (Stop)", "value": "c5fd9e1c8fc31944a99b419b1c3680855a37f8ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876643, "uuid": "0a557666-cf9a-4109-84e9-9deb438c357c", "comment": "Malware payload (Stop)", "value": "9fb2a4e914118a9780109a6a2c16c7a4127ab3c640f8f9199fe2ca50738e257f94139485b98b5c7962b586c176dc4db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876643, "uuid": "bcc2cfca-7e25-4472-99c6-f523af5b6f31", "value": "T198F41212EEF0ACF3F5269A728D2AC9E53FAEFC514E245657226C361F05712B08472379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876643, "uuid": "2a1630d5-f0ab-47b7-880a-138f2ff1963b", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876643, "uuid": "b2116ca6-185f-4689-8dfb-13928ad7d61f", "value": "12288:q2ip8a5YUBCkK1PEDRIDpaspVtJzP8IBhfUjUo73PXgdIvOLU7cz7MORe:q2lKpBVKIurjndBh2DXVvcz7MORe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876643, "uuid": "142842c4-8f61-4a96-a71b-ac4b4703485d", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876643, "uuid": "1097d2db-e35f-40dd-8ff5-55e2a80a9c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876643, "uuid": "1c6233ba-ec0d-4a00-b26d-0c05a0d401a6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb47cc7-0be9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686880980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880980, "uuid": "64eec438-ac56-4860-8a09-fa8a17fb5eb8", "comment": "Malware payload (RedLineStealer)", "value": "c0f1ad8e4509bf82f5d9a2dad26007a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880980, "uuid": "bf4fb669-c5f2-4668-9ff7-7ce24109ce55", "comment": "Malware payload (RedLineStealer)", "value": "441bb4d4e051b2c79398a8cd8aa996a8694c6ddc8ac8b1442c69c469f4cb74b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880980, "uuid": "224005da-071d-4c0f-b2f7-f263af583aaf", "comment": "Malware payload (RedLineStealer)", "value": "272521fc0cca11d57de27bbee8e82735cf2354aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880980, "uuid": "72499069-1ba9-4d72-aa3e-0c137d89e193", "comment": "Malware payload (RedLineStealer)", "value": "fa381f21a0d441061a2167c335fba2a3fad271548846d1ac2923dc8b91f7fad6d0caefa61034f846863d30eb85ec0032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880980, "uuid": "f86c1560-f146-4aa5-b8b9-84d6191f95bb", "value": "T1CB64D013FEE0AC32D626DB728D6EC6D43B1DFD518E24665723187A2F19B01A1C932379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880980, "uuid": "fe414b20-b014-4c92-bf4f-cb1e84c52e0f", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880980, "uuid": "0285e9b2-e1c6-450e-ac75-19491a0933ce", "value": "6144:omycZaHdH+0eqGTFE5LlGTy1Ak3tKxz6am099crDoH:omhZa9reqOE5LlGTyfPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686880980, "uuid": "67871097-a45d-4b88-86ff-e1f88f2115e9", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686880980, "uuid": "d23d7466-3ed7-4a61-9f0e-be504b654506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880980, "uuid": "163488c4-a3f9-4d9e-9a9e-2bfb90091f73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc573a11-0c31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686911932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911932, "uuid": "98479dc0-8e42-48d7-b2c5-3e0eb405b084", "comment": "Malware payload (Quakbot)", "value": "6d2d77f178489425c95bf9ee4858ad02", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911932, "uuid": "61f58bd7-3ad9-4d94-9eca-923d92c619ec", "comment": "Malware payload (Quakbot)", "value": "445fedd1f5b8d342b02cb1b1da446a91948407a2123588d6b8320acd7bbb9439", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911932, "uuid": "98cad590-b321-4248-84c2-de779e944624", "comment": "Malware payload (Quakbot)", "value": "592402f7d2a33a285a0663e23cb7c8aa33b48630", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911932, "uuid": "39cfa697-4ae9-4836-9eb2-33cba8343238", "comment": "Malware payload (Quakbot)", "value": "c5613fa8dccb58834d28d62110f41079336fcd19943f8b27b34a1b63076db61c93745a34eabf88f19b0484ddf6bd4d4a", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911932, "uuid": "28cf213a-6c44-4699-aea9-287782374de8", "value": "T13EC4821AA7491538C077B33ACE6B8405F93A172F2592851F7A3C91EC4F7983452B9FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911932, "uuid": "8c8c0297-ffea-4e77-982e-32bba900ad1c", "value": "12288:aWGJKxqUwYJpnwhdIhiZAwIQ4Cj8kA4dywL0u+p+fm3DB29vRQIXQrQHRtzggojV:auZ9KCkHR5ggoo5vuDf2Ag//nt0n4Grr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911932, "uuid": "d67e0a27-62f4-47a4-b2c2-2df3a8274e59", "value": 547658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911932, "uuid": "dbd5f234-9f3e-4a2a-83fc-c7492b744e0c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911932, "uuid": "a19a1933-c091-46a4-a288-85afe54a29a6", "value": "ZN9RZe5ehUplU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe3531-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903063, "uuid": "b7b59605-6727-4ce1-bf3e-4e0f005f77fc", "comment": "Malware payload (Mirai)", "value": "143b83f952bb96cc8da4b1b0deb59e5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903063, "uuid": "02e3863e-a07e-45ef-a239-9532cc026a12", "comment": "Malware payload (Mirai)", "value": "455cdae3dcdf0adb0adb3970a1206b9a1b474be3e77641e1e9d86a06a130804e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903063, "uuid": "15a96395-036b-4fd0-afa1-420427f69167", "comment": "Malware payload (Mirai)", "value": "5dbbb24534b1d14f5cc0513625e9aea09006b0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903063, "uuid": "fb887db6-4b42-4b40-a9a9-68f2de5b6035", "comment": "Malware payload (Mirai)", "value": "3be5de2ca18f061e8417f90343787ff6dc67d90250db859f0eed9e9006e7448ae3e5e4f68ef6602534c1a9b8d22f511d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903063, "uuid": "60222c61-4ccc-49ef-ae39-dc615e07446f", "value": "T1A1B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903063, "uuid": "06c6270c-23f0-4126-81b3-bf56cdc421b1", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ1oamm/QcuLB1niDNb:YuFX0GIk1MHyphyamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903063, "uuid": "afe641dd-3e3e-4248-9cba-829d9d70a4b7", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903063, "uuid": "04937182-edbc-4ebf-be31-00f137190fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903063, "uuid": "fafdb6f1-6acd-47c3-8d6f-6dabd3bd26c1", "value": "143b83f952bb96cc8da4b1b0deb59e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8f4920-0c7e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686944740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944740, "uuid": "e1d093df-4891-4b0a-9f46-85de8fd874e5", "comment": "Malware payload (Tofsee)", "value": "ed67a3bac84426dc7529083731194ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944740, "uuid": "2e6bc109-794d-4f36-89a7-60d067a3da96", "comment": "Malware payload (Tofsee)", "value": "462b04fb655d1680c23f4ca9cace1a30677ea7c5ec33efa9daf76a91891d4e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944740, "uuid": "d2d8cf50-79d1-4756-86b9-990ca3c3c640", "comment": "Malware payload (Tofsee)", "value": "7b85d76b46bc4f48a1a728f95733298b8fe04cb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944740, "uuid": "cef4834e-9e98-4a61-adc5-0c6dd774f0cb", "comment": "Malware payload (Tofsee)", "value": "2b3644368e0719f78bf7652ffe4eb19b97677da1c44209394f0a2254188ef52d29ef285bfad86611fb1c3bd2dfa4ba3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944740, "uuid": "3240face-ecd5-4b51-9e48-0feffa3e591f", "value": "T13F54D703A2F27C45E636CF728E2EE6E8365FF5508E49B76E51189B2F04B1172C263725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944740, "uuid": "778b33cc-ad3a-4ac3-aa15-220283b20654", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944740, "uuid": "4cf6797e-0071-4931-bf01-62ac3f9b54fb", "value": "3072:g3Nj1NjbrJEMFFEzW4tR2b7Ad1ApqX/8Q5qADwh5TQTh:E1NjKMHE64tRI5pqUAaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686944740, "uuid": "8d5bb2d0-19b3-444f-ba63-41f7e792dd87", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686944740, "uuid": "5206829d-eaf4-4d67-9250-a6fe63d62bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944740, "uuid": "f1967f6b-b309-442b-8b1a-a468b97fb9b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb089e6-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937034, "uuid": "73cb936d-f33f-46eb-9726-40be4f8a3fc7", "comment": "Malware payload (Mirai)", "value": "34a3b4930b89b045af278dce0d9ab9d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937034, "uuid": "3f324ef5-f7a8-42a7-9c07-254a7271feb1", "comment": "Malware payload (Mirai)", "value": "4673ca7c5c6c7284d0dfa825bcfa533c2b6c917e10c0be37b3c739f573e242ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937034, "uuid": "ef77fa7d-9025-46a3-b988-9679dced9965", "comment": "Malware payload (Mirai)", "value": "bc16e45487c21b942bc4926a217c25f6a2650312", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937034, "uuid": "b3b60990-098e-42de-bce8-02afa3009c0f", "comment": "Malware payload (Mirai)", "value": "38e780ff8865ec412ebd8b19cb3c6e4d5150cad51b371feab4d449cc248b1f2ae5b1a2a8fa901376a2ea539c22bf4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937034, "uuid": "6d5ef1ed-310a-420c-ab70-de492d9abedd", "value": "T10A3302626B6E29E252709777FC32FC16669C17E8586B30DA3CF0661977C18024EF27C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937034, "uuid": "1df8cd7b-5673-41dc-91b2-86e2613a8209", "value": "1536:99O/ZMAXIxNUk0bdLcPqF1aBexo4opKZbi:99O/ZNKyHdLGqFUF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937034, "uuid": "fefa0832-f1ab-412b-80ea-2d234ee27317", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937034, "uuid": "1299477e-c852-4b5a-80f1-84382a392e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937034, "uuid": "5450f6dc-88a1-486f-a171-1ef80d21e706", "value": "34a3b4930b89b045af278dce0d9ab9d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385a21a7-0c80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686945533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945533, "uuid": "331b85f9-0b24-4b1a-9a82-4f43808b6e9e", "comment": "Malware payload (GCleaner)", "value": "849ea4cc7e0bce3b5e73340760ccc6e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945533, "uuid": "1bc346ac-6d2d-418f-a541-380ccb59df3b", "comment": "Malware payload (GCleaner)", "value": "467efa0833405afba86a18332faa31fb1721ab020557d3e66e445d8ea3558d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945533, "uuid": "a5d8d4d1-e4de-4445-b692-857ffc5a1f1f", "comment": "Malware payload (GCleaner)", "value": "7488f6531f72eea224442aa4583eebc2e2404095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945533, "uuid": "1b3cdfcc-d09a-4acf-bf31-faf531f2b270", "comment": "Malware payload (GCleaner)", "value": "89d66eaf156a7da68de97e23409247510a186f4a55b44542bce11533ad52485bbd9d9c836876f87dd338ec1641b0fd6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945533, "uuid": "0863d8c4-686c-4ea0-ac21-949bfb12da7b", "value": "T1D5C53393A696AB70C52666B07E365D343F336C76003684EC2B6E76290FFB6D1449F113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945533, "uuid": "94a3a1a7-0ee1-4aa2-8bfe-4be26ade81d2", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945533, "uuid": "552f3ba5-abb9-4a6b-8f0c-abe571d86084", "value": "49152:U6dYu8CnYYOKJzrXR359ZsvG96RWZCcPjlTIfVq1JYnwDOZ:jdB0ozrXRJ9ZsvIbQcbFDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686945533, "uuid": "583bdcb4-bb10-4a4c-970b-f24babdeaeaf", "value": 2586277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686945533, "uuid": "717aa7e7-b3ef-4e4f-b08b-676158019aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945533, "uuid": "64de021a-5fc3-4b0e-ad1b-afe67c582205", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed2735f-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686925492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925492, "uuid": "bc339fc6-56fb-499c-9c90-05c14653b2c5", "comment": "Malware payload", "value": "ba43067146c6f4e833dbf56b6c8a6a19", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925492, "uuid": "545f570d-a39b-446b-8ba9-5934c1cb1e3d", "comment": "Malware payload", "value": "48ef01d559884f32a1dcfe9b3cfea04a157c865542ac953fccb5d5c81efdb19b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925492, "uuid": "e74bf200-b3cc-4b80-8326-89b68b2c7d32", "comment": "Malware payload", "value": "becbc73fc92fe339dd9ab1b3b65276eb59864de6", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925492, "uuid": "18e61414-3ebf-416e-b42a-f81a82e6b53e", "comment": "Malware payload", "value": "51023b5fb50269770c67941ed2ad4a9e30d0e4b8803fa7e30a41dea4867afbd27671aa04851f13b2400084f47a6a26c3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925492, "uuid": "019c18fc-7bf9-41d0-bf95-33124f2e7a89", "value": "T1DBE423A982D8CBFBF8005D34FCDA1743DA7C7593F400939BCA875F908E546BA9152AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925492, "uuid": "0329474c-89eb-49a3-9cd9-fc70449f7543", "value": "12288:7hDTMpat3P6tfTSDm2PHEAl0GB2g48ljdRLcPqQf+/R9P1SZQ1nkT7iesBYh:7hTM4t3SfWvR0GBbtkVaRhnknLoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925492, "uuid": "97750809-b288-40b9-b875-6df755eb18f2", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925492, "uuid": "7e754230-50b9-4b17-b5ee-c4926d71638e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925492, "uuid": "91eeda19-0760-4623-9652-39c5293cbf7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068a747-0c26-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686906811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906811, "uuid": "8c491986-8179-4975-bf70-e7a93f715188", "comment": "Malware payload (AgentTesla)", "value": "a671935aae69e8c2a1ee8b5c1c1f577d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906811, "uuid": "535d320d-ff0d-4c8a-8c23-1aa499e0e4be", "comment": "Malware payload (AgentTesla)", "value": "4913dda08726dc0fcc3b36bb5daf24556364937a7c4950698e8f2cc0691aefc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906811, "uuid": "b26310d8-ab16-40e2-9968-f7256af40cea", "comment": "Malware payload (AgentTesla)", "value": "81a71e7bfbcfe20379b082af2cc66803ac006402", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906811, "uuid": "4b4f6598-12e1-4f6c-9d1e-20f1a7351302", "comment": "Malware payload (AgentTesla)", "value": "f966b72a75804d802d8ac1955eb89a7a92566fdde942ff25b297e7a94f73706bce7b6624eedfbc0fee085f56bd145908", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906811, "uuid": "2d87eb11-7e36-4086-8e97-d3a9e39a5e17", "value": "T15FD423D55B5A9757D42B07F1DD68AA32A33F1691B82BC6530CC371ECABA1F800211F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906811, "uuid": "77544b42-0f2a-4e55-a016-5ccc54ae0941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906811, "uuid": "74abd5fa-5614-4de5-8016-54c4edff3595", "value": "12288:O5LbzIu9+r9kBo3+AnUQhObYyWo3eT3uXTINdVKjglo9YtAVZs5B:O5LA9d3BUQOObnS6tAE5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906811, "uuid": "8b47d890-6ac8-471a-9b74-3a2b259d98da", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906811, "uuid": "227d14b5-003f-462b-aa0c-5d6ae2b211b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906811, "uuid": "889945f3-1a6c-4bf6-b3aa-f5f23c973282", "value": "EPPCO Inquiry #18300231606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bb4c8e-0c29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686908330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908330, "uuid": "b43d8968-3c37-45a3-a164-503d0ab3e816", "comment": "Malware payload (CoinMiner)", "value": "fb2781d8cdbaa0632083ec5cd8bf1c0e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908330, "uuid": "fd26a951-5b40-43f1-a750-72708d088771", "comment": "Malware payload (CoinMiner)", "value": "491492bcb93bd8b4092a4cdec7d12fc17210d0a8a24836ab8eb42f48eaaf0581", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908330, "uuid": "5c4a81a9-3f4f-40e4-b38c-25321e3035f1", "comment": "Malware payload (CoinMiner)", "value": "10d620458fbcb79efe2555617431fbea8a0b19fd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908330, "uuid": "d370e4c4-9bbc-404b-a29e-6ed92033182b", "comment": "Malware payload (CoinMiner)", "value": "0bd713ebe295bbb549d72b14e9dfcc5e892439a9319ac7facfe4f37f3eddcb70b42e9e9741576795c6a8291ee5b77512", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908330, "uuid": "dbf5cf62-d3d9-4592-b9db-3a20a2ba18dc", "value": "T18365E73479021851FD4901F2B2ED293B2A006B560B78A95F3BD763CB97DE3E3B94E584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908330, "uuid": "9ffcf9a3-40f5-4b96-82b3-a47dbdb214c0", "value": "12288:vgydw3Ot187cN1SETiXyv9Z6A1v/3g1eE4feIX5Gg3UUH7WXqBYLBtTvxJjYRYWc:YZt29iiv9Z623XJIX+aBrJjZWhAvU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908330, "uuid": "88372804-4c31-486c-96d0-d4b782c7030d", "value": 1417728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908330, "uuid": "b08a8f6c-feaa-4f97-8105-7ee99a5788d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908330, "uuid": "ad3b555d-cd39-4b33-8a76-1f1aa078716e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc162c66-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900657, "uuid": "dcd54b52-13ad-413f-afe3-1ed5478fec68", "comment": "Malware payload (Mirai)", "value": "4853a8e80adfe9ce98aa86dcffcbe7aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900657, "uuid": "a629c6ac-f3ad-4dc2-9ddb-98c9e6322de7", "comment": "Malware payload (Mirai)", "value": "497f3195d7cec3c7d0917480b86895f6af0bfffa036e9405452417cdf3beb6c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900657, "uuid": "7c42dae9-4b6e-44d3-b856-a2b1d50d36c1", "comment": "Malware payload (Mirai)", "value": "cca5fc9198d34f73d1cba619239c7d75d032f027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900657, "uuid": "dae2a550-5ad1-4277-bdac-c9d21ee77cbb", "comment": "Malware payload (Mirai)", "value": "be8ff2c10a519067852a96a69eeefb78221e85952cf5b4da30acc4a74be0e84039dc601e5cfcc8765dfe7a98192ca721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900657, "uuid": "3bcb121f-f641-4755-8cba-a18b3408b5b4", "value": "T17303E160C603A0E399D40E73ABB88741474B7CF8B28DB2606DA54B7D1D561873C7CA7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900657, "uuid": "2fda60bf-f3e1-4c02-a922-4200ddbd328f", "value": "768:bPFp2p6LFlNeXikfnsj+q6CQSXrSK2jktedWNoj0SZ4jsKwQWX10HC4o3UZC:9+iNj+q6sSK2gedW+HZz7ZlwC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900657, "uuid": "995634aa-0243-4d71-8d4e-f5046d597bfd", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900657, "uuid": "e6ec88a0-7971-4352-b9c1-0750637f8829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900657, "uuid": "ce8d7177-29b3-4557-b24e-d812162afe8c", "value": "4853a8e80adfe9ce98aa86dcffcbe7aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c39697-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686925901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925901, "uuid": "c88c9f69-3fcd-4288-b003-32ebe442f33b", "comment": "Malware payload (AgentTesla)", "value": "823705096ac9b4f30ed41b4a3fae197e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925901, "uuid": "d2926820-8223-4ea0-adb4-c907d8b4d09c", "comment": "Malware payload (AgentTesla)", "value": "49ad7ac8d6e28582f693f893e0e664d2bf01f105cdc68e251452ead03774d70a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925901, "uuid": "72973867-da30-495b-9490-06653afc1ddc", "comment": "Malware payload (AgentTesla)", "value": "306b4b7eeddc84422488bf13c6b28c1116aa30bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925901, "uuid": "4bfb97df-380d-4b8f-8294-61b75e9d57db", "comment": "Malware payload (AgentTesla)", "value": "b5af14c452bff3d169809e6931e143218dd7288cdaeddbbc013ac6c96441a79aac970a33db33bc6929e5ee1d6efb7775", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925901, "uuid": "b26cf608-71b1-4f05-b232-723d44f36837", "value": "T15115CF9D355079DFC827FD768F942C74BAE469AB570BD243941318E89A0CB9B8F102E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925901, "uuid": "9d224183-1f76-44f2-ab57-b0ed6849d759", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925901, "uuid": "d8c9f289-55cd-4f86-8cb9-df01d194ad27", "value": "12288:IzG7EcvG73htU7/2eQ1x9DWJVrMaVM3I+JzpwIqzZUTSKgo+iiy7wPzivap0Q:l7EgG1tCuei+5MPXJVHSUeKKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925901, "uuid": "c1c7962c-a07e-4de9-a801-a090675093bd", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925901, "uuid": "65d57c89-6d84-409c-8167-48d8b07b7f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925901, "uuid": "fa36b8c4-7149-48d8-945a-1e0ca5d39029", "value": "open-order#456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ab7cea-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686922983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922983, "uuid": "b46723b6-5fd9-40d6-9bd2-da596d6001f5", "comment": "Malware payload (AgentTesla)", "value": "99eb4bf2e02cfcd0a50760ab0d6089d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922983, "uuid": "4392ed89-68a2-4834-8678-506c67f973b3", "comment": "Malware payload (AgentTesla)", "value": "49bc579c76fbe3797d8ef0defec51d64087fabc11dab7f537042164c45c33846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922983, "uuid": "c63acef9-1f83-4047-944d-ee8744c653d6", "comment": "Malware payload (AgentTesla)", "value": "f0b641ab870129882954d837ac61c6480e8bc8ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922983, "uuid": "279a5868-3f33-4d01-93cc-f540152a5905", "comment": "Malware payload (AgentTesla)", "value": "b69255ffea1e5027f255e94db455aac04ba6393e17e84fd74943837dc15c32ece8c7e2a2298624873cafb9c406e7dea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922983, "uuid": "a1c5cbfe-b22a-4e36-b017-76a846c23fd1", "value": "T192F4020876DD9833C6FA0BF5D44111B193F3A06AB246E3C66D4F78E9A6D2F8C0D95683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922983, "uuid": "35de248f-d709-41c0-881a-7998598393cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922983, "uuid": "2802faab-47fa-419b-af87-7314adf0c875", "value": "12288:m5o+pa26Y0Li2MT5ItXknk+AbRx4W67f/zLGBSAVnPEXqXdVu5:Ko+pSYa7Bynk+AHo/KhP4qXdVu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922983, "uuid": "9fac1119-0789-4c30-863c-7062c686b016", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922983, "uuid": "dee9b11d-e31f-43f7-8cf3-b358a24dd7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922983, "uuid": "ac6e5a43-a271-4e66-bad2-0f947071d618", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de348e5a-0c21-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686905009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905009, "uuid": "33fd0a93-37e2-4d50-bfa5-86f943a52abf", "comment": "Malware payload (GCleaner)", "value": "742a4c6151f49c85e0f46df7a91598d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905009, "uuid": "019592dc-d183-4240-98d2-0ae7d38b0c30", "comment": "Malware payload (GCleaner)", "value": "4ad21112151f0441a9be7b9baca55a7595491c7e3bb0f8b9247eb3054adb9143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905009, "uuid": "f486cc79-14c8-4f51-84c1-a991fc1162ad", "comment": "Malware payload (GCleaner)", "value": "41971e5694a8795b1a212ba8ec0d69a8c4012b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905009, "uuid": "b649dcc1-042e-4bf9-8647-cd4a02124773", "comment": "Malware payload (GCleaner)", "value": "11b9b4f3a00e1baaee9b106c7483aaf2785b2398d9db5e9a77dfceb735a1ec9c71cfdb6831b3704d1d0a01fc9515af73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905009, "uuid": "201b1481-a582-4ee4-a503-89348ab3c1e9", "value": "T152C53343DF8998F2F83363B8D8328B22AD5B7D775534849DA30E35291E3A1DB1D4162B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905009, "uuid": "33bf7218-09a5-4ccc-983b-c1da7c015007", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905009, "uuid": "907a402a-fd9b-41f8-bced-f397cf2178f6", "value": "49152:86dGy0usHl1c4RlMduFfroshrycvDP17zgeeld6Xa5AIx2bInwDOZ:bdeHZg8fUohzgrIIx2TDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905009, "uuid": "c2f5f675-b5ba-4d6a-91cb-9aae743393b4", "value": 2631953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905009, "uuid": "268c8d1e-3682-43ee-8844-85e66d101dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905009, "uuid": "2767c74d-7a03-4b8e-ae6b-e4dd2b1a472c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6464f1-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686906271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906271, "uuid": "a37be6c5-be45-4896-9fd1-22ec34558856", "comment": "Malware payload (Mirai)", "value": "eacf4bab7cac14cd4e1156d3189e77d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906271, "uuid": "ec751091-8907-470e-9a03-43f964c69f86", "comment": "Malware payload (Mirai)", "value": "4b04b100dd1723288a124b9d8300f3553a5ed8d70c05e125175062a0b8796a6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906271, "uuid": "4e2638d9-2c69-4684-831a-cf341caae3a6", "comment": "Malware payload (Mirai)", "value": "88d81051f21e7e0fb8e7680f273a5111c919bd3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906271, "uuid": "afde47c1-a8a3-4478-a2fb-5d2709bae0f4", "comment": "Malware payload (Mirai)", "value": "de8aef01499c1cf76066b3298ed5885e89c724d6de6ffd2d49ce7112cf427591152102db15be1a490783a876274aca78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906271, "uuid": "422bf1de-af68-4011-8601-e6d1973f20e1", "value": "T17F835A22BA361E23C0D5A07721F78721B1F053CE25A8C62E7D721E9EFF255406547AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906271, "uuid": "6e01868b-43c1-4df7-adaf-744f4e3a20b8", "value": "1536:uxRW+cIh//3XqkBlIyxvj3ZA4QvLhZydVT5BgUOthrwbZn2de:qZxnFjacVNBgVrwbZn2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906271, "uuid": "35e70507-78a1-40f4-8ca1-d9fbb5aa5565", "value": 83976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906271, "uuid": "8a0f91e9-a78e-45b7-afb5-6e66f885daef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906271, "uuid": "c3d3ba15-77c3-49a1-a7fd-e3a3da10a529", "value": "eacf4bab7cac14cd4e1156d3189e77d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91fd704-0c30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686911389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911389, "uuid": "cff9b890-49cd-45a7-834d-745243a0f287", "comment": "Malware payload (AgentTesla)", "value": "365b0eeb5b5a210daa6188d3040ac071", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911389, "uuid": "e6823c7e-0ca3-4fb3-875b-39103361e43c", "comment": "Malware payload (AgentTesla)", "value": "4b1884d816c4abd76b64c4242121321a82fc123dab8f17dac0a303a933c38daa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911389, "uuid": "3861535f-ae76-46ce-98aa-4b78e1dbc13c", "comment": "Malware payload (AgentTesla)", "value": "5dd4f74e1f1c15555802cac754e3116d4c5304ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911389, "uuid": "4e8e004d-3e15-44b9-be04-e25e8f5f465e", "comment": "Malware payload (AgentTesla)", "value": "c1af15e5ebd959cffc69da8914c26f145afb7da7d986dcefc55651e9bc10b5a48ee549c2415c442a038d9172ec25536f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911389, "uuid": "e40a380e-ae51-4ef4-ae69-fbc724f73f38", "value": "T18504A520FA47CC76FA21463137D5F16202426D637D59CE662AC3B20E07F7B506CBAD9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911389, "uuid": "1831f146-632d-4d26-bfca-8526d435f31b", "value": "3072:U0kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nARXN2G86B/fplwEDcv5VoghSJ6Pdu:EZ+RwPONXoRjDhIcp0fDlavx+W26nARM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911389, "uuid": "84127012-0574-476d-8f1d-e30ecf7797ee", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911389, "uuid": "1bf60d24-0d49-4c1f-832e-b105310aa520", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911389, "uuid": "e0dca217-782b-475f-a157-faf4c619c999", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.Gen.8178.24172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89323f56-0c32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1686912168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912168, "uuid": "99ca1478-2191-4a17-9c0c-f5807e0deacf", "comment": "Malware payload (TeamBot)", "value": "e63f6653632bcce95030abe64ebe5bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912168, "uuid": "250ad0cf-0aef-4dce-a384-594dc0ffdd3c", "comment": "Malware payload (TeamBot)", "value": "4b25ea36c2b25f78c82b2752760b9b667678d3ce95dc292929b570b50e8bcc57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912168, "uuid": "21d45119-561c-4a84-b8ef-bad92e2356a9", "comment": "Malware payload (TeamBot)", "value": "f4fb40af106f713c17d3322f5211d9572550312f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912168, "uuid": "4c9c2269-200e-4ca8-9cac-a365db2bf8d6", "comment": "Malware payload (TeamBot)", "value": "c0ce7bb05282298ff697519e95bdc77a5b56d4b65077581287a453d3d587a18802df6a5c0082e563198992662ebe34fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912168, "uuid": "af4c9de8-79b4-43b7-8235-3c08263cc903", "value": "T1B6643A1362E1BD50E6665B368F2FD6EC761FF210CF59B769221A9B1F06702B2C163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912168, "uuid": "7b9127fb-e321-4e8c-8deb-c41bb0adcf67", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912168, "uuid": "8aa24a5e-c1a6-440f-845a-516c711eb569", "value": "3072:4p77XS9VtvM6p33xOdKYPYOAPqKDghwG3viqUwX5SN9LzZ4KB:S77C9rvvROdr3Ahn+iqUwQfhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686912168, "uuid": "716ca8ba-45ff-4241-b5a1-0186c54bea58", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686912168, "uuid": "35e40b3c-c490-4954-b027-364433188bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912168, "uuid": "e69c3360-e60f-4415-9be0-7b4fac2ce9b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5dfafe-0c5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686929786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929786, "uuid": "28fbb7ab-b200-47b6-87e2-61da00346681", "comment": "Malware payload (RedLineStealer)", "value": "0f01ee95905898526104bac8d0b3339b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929786, "uuid": "85dd296b-78fe-427a-967b-0e74ba745f44", "comment": "Malware payload (RedLineStealer)", "value": "4c313f3f72094ea68a3e98db6778ce4ce9f38d3ba22e3b4b752a7a95679b1b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929786, "uuid": "60ddbbb0-66de-444b-bce7-d70ea263c46d", "comment": "Malware payload (RedLineStealer)", "value": "146d9ebb83bf9ced19564f8ab050cb3d576ab832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929786, "uuid": "493cf58f-b317-4c1a-bf81-e03660ce8c8e", "comment": "Malware payload (RedLineStealer)", "value": "8586c2c9aeb97e35ed0cdfc059f94d7e6c9ce67e0c767f58b4c8f9979b3d9642ba4adecf5fabadb03e5c356330f30cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929786, "uuid": "fbad51b7-8cd0-4593-afad-64f89ad93cd0", "value": "T145A44B03A2F37D91E6668F729E2EC6E8361FF6504E1A77AE52149B2F04751B2C173321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929786, "uuid": "efd1eea7-3cde-4dce-9da8-f41135189c3c", "value": "2ab0162bfd91ce0b6db4856e4b4f264d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929786, "uuid": "60fd95e8-d42a-460c-ba51-bc8c60cf4a41", "value": "3072:V3dy1s3sQZ1SG4G668CAGn++Qas77fsi7anwZHbD2AHDKL6JYrLvfiwRcybXd/sA:fsQl4rGnAas74tnYhDKDvfdBbXTVBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929786, "uuid": "c65ef2b6-fda8-4858-b505-93d19ef27091", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929786, "uuid": "4eae5054-1982-4de4-b71d-b84ef0333aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929786, "uuid": "9d001aed-8196-495f-a0ff-75656f62f93e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53906fe0-0be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686877289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877289, "uuid": "451eaaa8-23c9-49a7-9fba-e9ef05a4f6c1", "comment": "Malware payload (GCleaner)", "value": "ddbcdc85b76c41afdff34e020cdd282f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877289, "uuid": "0df23753-c224-4d55-b2fb-4cd4f16f4265", "comment": "Malware payload (GCleaner)", "value": "4d08fa44c995de1ea4701acef2999ba70e0735649de106c1222067b5ba438d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877289, "uuid": "2c472382-bbcb-4300-9f80-86c3924f4f39", "comment": "Malware payload (GCleaner)", "value": "a1343b3a2c4a250a66759449ea387dfebce9cb1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877289, "uuid": "4844b439-63f6-4775-a9db-a135cc68822e", "comment": "Malware payload (GCleaner)", "value": "29f1f79feb60fdbfeb00e6ffe759f623f6cfd5ae456703e7881328fe7d7726ff2c140ed1d1584a6101c3c2fe31b6ea9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877289, "uuid": "3eefcef0-9ee1-4fd5-98db-941ac339991f", "value": "T18BC533C58788A670EC6543F12477B5214F5B3DA7E23510AC2B8EF6261EB71C708AA74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877289, "uuid": "00af69e1-b51d-453d-91ad-c1ecfa823abc", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877289, "uuid": "d2b79232-c5a6-4e73-8770-8a5b85345934", "value": "49152:46d9niwRoP9Jl1yKetOpvqehSOXU98hwtkymqMs80XYBrwxWRPZCoNSEGvw1PnwY:Xd9nxRolJBCOHhwtB1MshWRBCoUnvw6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877289, "uuid": "9c88fb6e-4487-4e65-ac51-873f1c714838", "value": 2743707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877289, "uuid": "bec365b7-4c5b-46de-b8f2-0407760e6796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877289, "uuid": "1fd12a1b-2a90-4e81-86c7-6160a5fa3195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7294f6-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900681, "uuid": "fb7b1e6b-7367-49d0-af31-dfd445463b5f", "comment": "Malware payload (Mirai)", "value": "4bce86c0060fecd5d7e285f91c05b3e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900681, "uuid": "306302d3-634e-4c2f-8632-4a05d7db3c49", "comment": "Malware payload (Mirai)", "value": "4d25561e7c94b758be93b958a4b9f2df1ad5837b0b13b16199220bd4f32aba38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900681, "uuid": "768604eb-0778-4565-b7c3-113636d1d222", "comment": "Malware payload (Mirai)", "value": "892f0655bd444d7454a0270803d3dddbc93fd0a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900681, "uuid": "c948722d-ae33-423a-a215-c31d249c36f6", "comment": "Malware payload (Mirai)", "value": "f8addf915130f7e6f0f646ab121eaa77d0dea2f980f145bbbc725c05d10ccc01ddc816fc4972a8f2001f9702f050a37c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900681, "uuid": "0b795e11-0f1f-4959-967c-f03b43c047d1", "value": "T1F6A2D025D345BEF4DFAF9D9493C2C2C276E987C6278AC8E340EEBF012506046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900681, "uuid": "ac65e174-8727-4fef-a7b2-3d8425733a38", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5XAM4uVcqgw05VxJ3:9RxsSVsMD6xiJJE5zRWN14uVcqgw09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900681, "uuid": "f75854b2-5e43-42ce-a216-31e97cc2a811", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900681, "uuid": "ec586b07-3d83-411f-a495-0ff3b2448eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900681, "uuid": "b018b4ae-e0d0-4972-8b3c-4eb51b53a355", "value": "4bce86c0060fecd5d7e285f91c05b3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d5ebb2-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900705, "uuid": "a5b9dbb5-c995-4bea-9d8e-fca610fbec71", "comment": "Malware payload (Mirai)", "value": "7f17930c4f94dead01860443c8041548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900705, "uuid": "3af84121-bde8-4623-8b3d-faf1258ae522", "comment": "Malware payload (Mirai)", "value": "4dfbe9cf908198735539cd9a6465ef21d2f5136a40bb99c9f9393a6039a2f5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900705, "uuid": "d7563dbd-ae03-4282-a3c8-724440580387", "comment": "Malware payload (Mirai)", "value": "5c7f91fa2a0650428866957b1801edb14f1b1ad2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900705, "uuid": "0fd24ab8-1954-4510-a787-fb13d8c059a4", "comment": "Malware payload (Mirai)", "value": "1fe9b389c935f805ae302232ba2f9c3b8eff610b479cb76e583c46af484a26336241051daf890e2f5b7cb4f82aae597d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900705, "uuid": "bf6d8c27-afa9-46b8-bf32-fc19b88a92a9", "value": "T121831846F8818E16C5C513BAFA2E118E331317B8E2DEB2269D14AF2077CB92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900705, "uuid": "00d3ead9-7cfd-4249-a3c2-14bea6698928", "value": "1536:2Rnx6mu/B72ccGKj0ATxSaCAHIkgqPDIVFmEiNKXHuWXUnaC4tL4IJi9bXVDdu1/:q6poGg0KxpCtkgcDcniIXuKMaGbXVDd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900705, "uuid": "2c3c63ce-3f0f-415d-a4a3-41b2a3e5e863", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900705, "uuid": "41048df3-ae93-456e-9353-cedb74a440ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900705, "uuid": "f5b15326-3e2c-482e-8839-73617d5d51e3", "value": "7f17930c4f94dead01860443c8041548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d9a8fc-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686914254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914254, "uuid": "0be71e76-335f-40ba-bf97-b396f8138c86", "comment": "Malware payload (SnakeKeylogger)", "value": "25e0cfa8dd748a0e8dcffd9bfafa5ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914254, "uuid": "fd00dca8-de2b-4c6c-a40b-1d0c436ffb3d", "comment": "Malware payload (SnakeKeylogger)", "value": "4edd611ce923d3b81d214e14f48bf8a3b0f5237dfc0313b1c9d539816664d0e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914254, "uuid": "8b3f144d-660a-488c-a0d8-ddb0b19fe26f", "comment": "Malware payload (SnakeKeylogger)", "value": "7b3f1af4d35c4b0b57adbf3a3c5b3784f4754064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914254, "uuid": "13f6b847-88a0-4514-b39f-d542806dd0a0", "comment": "Malware payload (SnakeKeylogger)", "value": "1faaf0d13f840b3e92a8f65eb18b36b118532b9386ce5b4bcc82464da05318d4b132acb552791d159b3ca1829151e75a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914254, "uuid": "51c3f77e-d12a-4649-a518-3e8b0dc81eea", "value": "T17EF402046695CB1AC07F0BFA455025318B36A32BF477C71B0DC6B4FA2EA2B93515EB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914254, "uuid": "a2134a3c-75b7-41f9-8064-be06935a8ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914254, "uuid": "adbbe762-1799-4dae-aa77-db2ed6f1b73a", "value": "12288:MNxKba2iNx5LbzIu9+r94zM53FH8rsj1Dq1U4Sjjcm907UkyyalrNIFoDUKlc9:uEa1j5LA94Ilcsj1qmkUF9DUKlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914254, "uuid": "e28c38f9-e1f6-4371-a2de-a24655f77b2c", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914254, "uuid": "9d8b93f6-2734-4e46-9d38-bf8305cc5d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914254, "uuid": "5b31f762-e843-4cac-a414-5befb2a79aaa", "value": "PO-0001050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e615e39-0c53-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686926377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926377, "uuid": "916bc23e-c914-497f-8327-ab269049bcfd", "comment": "Malware payload (Formbook)", "value": "f37bf92ce69212f443da8dc21b93a752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926377, "uuid": "feca499f-7634-44a9-89af-09442fcaeb54", "comment": "Malware payload (Formbook)", "value": "4ee83ad8ea663587241427cf04b35ed5f7c569d4d7395512826b7a7bb6ab3d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926377, "uuid": "196dabfc-c997-40ad-83b2-cf0a35461810", "comment": "Malware payload (Formbook)", "value": "953c62fbf09b57ac9c09dc9e92d7728dbdae99be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686926377, "uuid": "f452b4f4-6219-4ec7-914d-79fbfdb8244a", "comment": "Malware payload (Formbook)", "value": "f31497e5d93255fd485be33ffe7273e37120dd5b842d000aca16cb96e134918e656fc475ab124dc6f4b600d51c42dabe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926377, "uuid": "12d9bc81-4086-4b39-bb4f-ae9074ad8f61", "value": "T17A35F18960044056F8E57B794F29E83233EA6FA97878E1CE26F97C5737F97430021A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926377, "uuid": "c6a731a3-93f2-4bc8-b068-df0423cdb33f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926377, "uuid": "d0702845-7540-4447-8362-dbe91ebf1cd9", "value": "24576:7zhgG1tCueivXWG/8PwE0uI8Cr1cWvZA2pPcX6KKKKKKfj6:7NgqtCDieGkgjeWvDpPo6KKKKKKfj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686926377, "uuid": "30c67278-7889-4bd1-abf5-0035a500baca", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686926377, "uuid": "2ee4de46-8bda-472e-a07a-70427d3fac4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686926377, "uuid": "9188a272-3c76-487a-ab58-119f1b38239d", "value": "Atlanta Packaging Technology & MachinaryBANK ACCOUNT DECLARATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc410a01-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908925, "uuid": "fbc913f8-e867-4ca6-9750-6f12bf976178", "comment": "Malware payload (Gafgyt)", "value": "af789b37a9874f7a83cd9115f0568b25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908925, "uuid": "48ece78c-26b9-4a20-a686-dfc838ef2838", "comment": "Malware payload (Gafgyt)", "value": "4f0aeb23c14da31aaaf0717326bbcb271c0d0d8193c9336f7d19818fe4acc571", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908925, "uuid": "f42bc9d8-df53-47a0-9c9f-74ef900c0479", "comment": "Malware payload (Gafgyt)", "value": "3860b57d6a95c11eb449b6fb3552a29559c64163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908925, "uuid": "360500f0-a52b-4ba9-a011-10e6bf30a522", "comment": "Malware payload (Gafgyt)", "value": "2be05e9e39b4aca7e45874f4fcc26a2d2fb814f6cd7ab4382cb1cd5fedb7f6a86554749fa50bdfe86b376fc0223485ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908925, "uuid": "d08c34f8-d22e-4c58-8eb2-e46051823074", "value": "T108E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908925, "uuid": "d3f1b5e0-7a82-4780-ba08-588c07574ab3", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hH:vY01ZkXAQT4N+9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908925, "uuid": "224b3a54-a224-4d4c-8940-12c71a670156", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908925, "uuid": "6877bcf1-b1e6-4bbf-ab24-d486d0b4f018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908925, "uuid": "a1a359f8-4940-4975-b8ae-22a29e327233", "value": "af789b37a9874f7a83cd9115f0568b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b575417-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686914292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914292, "uuid": "4d704653-947e-44a1-8d30-d7b43d97c2c2", "comment": "Malware payload (Loki)", "value": "056f5ae62038d26537b93f72dbbed514", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914292, "uuid": "8d389b3c-a8b7-4b9c-931c-96b3cbc34ec0", "comment": "Malware payload (Loki)", "value": "5032eae023119eb538189c2e483a1acbb4a2f0c1f56cfaed007696ec91ef0443", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914292, "uuid": "3cf7ed69-031d-4e26-bd5d-a2111d722b9a", "comment": "Malware payload (Loki)", "value": "f407a31aafcbaf1476853dcadd911ad25d0433ec", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914292, "uuid": "a76bec6d-91d8-45e9-9651-0119fe8a99b0", "comment": "Malware payload (Loki)", "value": "4d60c4542b6b0ce6597182be70960e579e157df26530af7e43ecb7e4cee33508791097667cf47100343ccbf70f320f34", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914292, "uuid": "99197886-1615-490a-b576-27866e2f35b8", "value": "T1C3038E5AE78E02648F5103B3671B0E89A6BDB63EB35155B1385C933433EDC3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914292, "uuid": "937a5b12-f7f6-4a6c-b949-9e89613cf3f3", "value": "768:7Fx0XaIsnPRIa4fwJM2XoeB5nXZf7MwZ2wVvH:7f0Xvx3EM2XoURJMwkwVvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914292, "uuid": "c946296f-e779-4d92-8663-5bf15b8e19d0", "value": 37791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914292, "uuid": "4110daa4-392b-4b72-8d1d-70a4a1bfc17c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914292, "uuid": "63c1965d-4343-4aa2-9c63-9ccbc8116591", "value": "Swift Copy 93,691.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df935d08-0c5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686931640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931640, "uuid": "9d7f1f63-1e88-4c64-97f8-d1058ffa363e", "comment": "Malware payload (njrat)", "value": "4ea1a922126cb80f8dd45d3303146a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931640, "uuid": "9a071c05-16d6-4fff-8207-ff5865f94cba", "comment": "Malware payload (njrat)", "value": "5047d7914217f2a32b227be477e244b47bfc20655886202af6fd536c01e5cef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931640, "uuid": "25fb3724-223c-4b5d-94e0-5ba45dd17088", "comment": "Malware payload (njrat)", "value": "84f1a0ee362d3888044f93a981831d70a47abd18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686931640, "uuid": "508bf6dd-6bd8-46df-bd06-2e042dc6c648", "comment": "Malware payload (njrat)", "value": "519c5b34c9fce3547480eb3ec96c595f5f35d2a53bf6f78075358cc30aabeaca8c49bea09a16133e517b56282a851977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931640, "uuid": "0178ce8c-ee26-456e-b11c-1b4d9322a2d8", "value": "T111E208067BF98215C6BC5AF88CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931640, "uuid": "b35a91a2-bed2-4dcc-8515-62f2cbda1ca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931640, "uuid": "3b65a93e-91b0-4a22-a475-0dccb9196103", "value": "384:90bUe5XB4e0X7OVcsw0Q0mS03AWTxtTUFQqzFlObbR:uT9BuC6555dHbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686931640, "uuid": "4708fa41-96db-430e-ab64-4b26c9663ed6", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686931640, "uuid": "7a0777c3-9290-4cf2-b452-46c63fbdf6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686931640, "uuid": "eb4de65f-dce9-42cb-8fe8-0425bc278b94", "value": "bN7R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25701943-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925745, "uuid": "29c479d1-370f-4b03-9594-4c4ebd1d1c51", "comment": "Malware payload (Mirai)", "value": "c60f9a04e7a4e5a87e0f81378b1f0b33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925745, "uuid": "0227abfb-10ce-40ad-8cc0-c7befb6b51df", "comment": "Malware payload (Mirai)", "value": "51768c76309c79c6987065ea6014e74f8293aabefba813c84f35580c671f80df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925745, "uuid": "812be3c0-6fa5-477d-8280-0f99d7482ad6", "comment": "Malware payload (Mirai)", "value": "bc64dcce036b091ec9905303ecf37c930713917f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925745, "uuid": "50ddadba-6d3b-4353-95fe-06389dde4d26", "comment": "Malware payload (Mirai)", "value": "3b910b991d9011954980ea334e61892a7849d2509cdf973c0ddc04b041092e787b93d6b82e0c2899da57afc1add066d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925745, "uuid": "56a78303-ac49-4b2f-a3fa-6714428a60a7", "value": "T13BF2E1F3E54C32A3D6D51A36F97743C11A4EBAE49CCEB2BF236505B0ADD508A2D29910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925745, "uuid": "ab783e31-3577-4507-a207-54f032a7feda", "value": "768:VPEcDy4cEsyWTt8F07JcLjCd78iJdrqRKDc5aMVwzRYDaKki3UO:VP//sNeF0lyS7OKDTMVqRYDa9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925745, "uuid": "da7aa6cc-ab1f-4762-8b2b-ff0db16d4708", "value": 35964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925745, "uuid": "04f87e94-10a6-41fc-a400-ae8b8b29e9f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925745, "uuid": "b28b38c0-7dc5-42b0-a54f-5abe5374cdb4", "value": "c60f9a04e7a4e5a87e0f81378b1f0b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab72a0d-0c41-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686918452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918452, "uuid": "9305620e-9a85-40fa-9bdf-17fa9d5ef859", "comment": "Malware payload", "value": "a51a0933a17256d1864f0a004c36ca16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918452, "uuid": "8d39e93d-a2b5-4b15-8530-58f1402b853a", "comment": "Malware payload", "value": "51934437ddf04e3f0f2fe26119cdc400870e021484cdfe76a1bcf35b2f36d196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918452, "uuid": "a8673e43-ed3c-4c63-9c7e-4811f7500c05", "comment": "Malware payload", "value": "53792066799c65224b128507210e84f6730b5a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918452, "uuid": "3b08145f-9cf0-4a22-b0b2-0fe9ec4b1288", "comment": "Malware payload", "value": "b43f050a4907188eed08182ccb691cf5db737433168ea7dd2bc10a913db10cd580c63ab1efb004e4efb2692eff819f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918452, "uuid": "18c605ae-9123-4a40-b72e-75c5c6ab1fde", "value": "T12C46334453761AE0FAFA853E8C518817E6B2BC354361CAC707B4632F6F17AE2593AF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918452, "uuid": "e2f2fcc7-dc12-47f1-8f55-8c2dfcdf2f9c", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918452, "uuid": "957ff6f4-6b61-495c-9a53-fdd91e5bdfac", "value": "98304:6WhGNijJ/JiXEvUlESEXVDI5wzSDlDV99+HbXU6SpXqCI3UVvUb7YqMrTx:6iqi9xeEK7xwWDlDVb+7XxSECIwUH5Ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686918452, "uuid": "a43878ba-ed95-49b9-919a-5e86e8db0d9b", "value": 5836154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686918452, "uuid": "845245e4-b6d5-4952-ad2b-54260b8e5f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918452, "uuid": "b9cea6e9-6d9f-4c4b-9527-22a186936c31", "value": "\u7533\u8bf7\u6587\u6863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1920197-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686913524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913524, "uuid": "25af0197-02ee-43d5-9bec-445ec8cd60ac", "comment": "Malware payload (zgRAT)", "value": "e5b2eb6d938c08cad96c931c75697d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913524, "uuid": "83ab63f0-b163-42d1-b8a5-596b7239ab8a", "comment": "Malware payload (zgRAT)", "value": "52a1809773419caafe264fc932eb4dc72f45e59401ea3c3e73072665ae1ada6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913524, "uuid": "8996e987-6a3c-430c-b1ae-9d56108f315b", "comment": "Malware payload (zgRAT)", "value": "a5269679ac3c67c26a782cbdaa49ed0b0eaedb1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913524, "uuid": "66ae4453-e5ac-4a71-8063-41c3f04cddaf", "comment": "Malware payload (zgRAT)", "value": "a2d5dc5ef5e2ccb3618d2358c9eb20acf650f6e946cfc2ffcdfdbd419434f3f5497bc277fe508f864a7b229c28ffa3bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913524, "uuid": "95d411ca-3c2f-4535-b022-ac0fca0a5c9f", "value": "T1CB34AD897691728FC857C875C8EA5C6497A1656B533BD303A48722EE8F4D7CBCF006E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913524, "uuid": "1d3501bc-9b6a-4f23-80bb-c796e83ee07f", "value": "6144:ETA1rj44t8kt9KyjEOnOb/OPQnDAda3wn0/R:T1rj44NIQE0fd5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913524, "uuid": "419bf2b9-eb8c-44b5-bddb-ec9b8ebdea8f", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913524, "uuid": "3b47c4a3-587a-4d38-a8a8-7903ebf8993c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913524, "uuid": "182a252d-0003-4e2f-ad4a-f45b77e9362d", "value": "solm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72a2138-0be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686877107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877107, "uuid": "0eae5fb1-a674-4598-b8b1-660d531188dc", "comment": "Malware payload (RedLineStealer)", "value": "8d69a72c18616b0dc564ef7c5728d0e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877107, "uuid": "230cf1cd-fe18-4357-9980-3c5edbc1b7c1", "comment": "Malware payload (RedLineStealer)", "value": "53cbd1bb6b982586b06ebe369344f59f6614c1742030ea380404014a42a410e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877107, "uuid": "80fae032-88ef-4eb6-ae0b-b398cb4ec3cb", "comment": "Malware payload (RedLineStealer)", "value": "4314c40e85a761e80aa9c39e7072ed61b9c77aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877107, "uuid": "599b629a-f938-4590-a929-84cb7602bb5b", "comment": "Malware payload (RedLineStealer)", "value": "f9cc8c7a289ddb1475b62ef304afbc397373d010ab79d238ac71e99f23db201ffa0c2926cefa26a188044f392dac2cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877107, "uuid": "46074f55-682d-4a2b-89ec-6828aef7c62c", "value": "T1D1446C0335B08FA9FCD792711D5C9AAF0E79B5902845918EE2939DEF87D4190DA3232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877107, "uuid": "d5a7190a-850d-4229-a5d8-96ab4d2011d5", "value": "d7603d1b17202cdd1d003c27d46c04c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877107, "uuid": "b9f11862-a85f-4db4-9a81-a5a0b743021a", "value": "6144:O5G3wmxa9w2COOKSwIcN7iOYA1ktKRRVeN/:OEfxa9w26KSskgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877107, "uuid": "efb4f80e-9155-4f67-9aea-f5b3aa89a763", "value": 261752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877107, "uuid": "15944e7a-5208-47f3-9c86-e1925bb87d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877107, "uuid": "2d0d926f-9a06-42f3-b741-893dd77829a3", "value": "skeet_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7724cc23-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897535, "uuid": "14a65235-878b-47bf-8ea0-2756ac725e44", "comment": "Malware payload (Mirai)", "value": "e1cf93ea16c4aca85c869b90bdc4c8c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897535, "uuid": "58d87edb-aaf5-47a1-ab6c-39e60ce0afbd", "comment": "Malware payload (Mirai)", "value": "5411e46a808dc859f66e0161bf1f9aae024cc29bc0f2ee6807fcc7b7b1e23a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897535, "uuid": "f3c9cc6a-cc00-4b01-9e81-2832b48099c5", "comment": "Malware payload (Mirai)", "value": "c6453971126971cbf0f278624f9fc469271b080c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897535, "uuid": "c374324a-05ec-4d80-bc5e-3ce0dd73eef4", "comment": "Malware payload (Mirai)", "value": "b1cf2717b4752ee27db20e47558b9d9109ddda56b0573673275b337668cf881a10df62a8dec2f46566088bdcbb0d9297", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897535, "uuid": "ca1f160c-e009-4f7c-9a1a-c5e637ad310b", "value": "T1A4539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897535, "uuid": "fe596e40-c63d-402a-8bc7-fc0c0a9d3aed", "value": "1536:PaAtVnz1/mUUNztiYmW6bhiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwNtT0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897535, "uuid": "5a16894e-96ee-44b0-8313-b2fef2706bf9", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897535, "uuid": "5f35dbf5-69e3-4e6a-aaf2-e336c83e25ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897535, "uuid": "4060d72a-0551-4d5a-9710-3611c1fdfcbc", "value": "e1cf93ea16c4aca85c869b90bdc4c8c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9e4fbf-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908897, "uuid": "91965365-4136-4297-9e61-0011ec220d06", "comment": "Malware payload (Gafgyt)", "value": "4382584d1a20f4a5e126248b1321d6af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908897, "uuid": "b70644b6-6c55-47a4-9b6f-7c3bf9f04f70", "comment": "Malware payload (Gafgyt)", "value": "54ef08eb147380e7de72d29f2a1ebac5c305ad0451bbd5f2db90f8d13d809a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908897, "uuid": "e3e118d8-a1b7-4c8d-b959-f183aa481e26", "comment": "Malware payload (Gafgyt)", "value": "06e99051114fde77affe5640b442db23832bd5e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908897, "uuid": "5499a245-9bec-4ca7-8ba7-8079bf0ae132", "comment": "Malware payload (Gafgyt)", "value": "c4b0c005c7254ef3f0c38bedc757a0191c6ad5ca2fdd99cc150e583fa9d54e7ae3768c23f31d45ff8267b7b9eda0f658", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908897, "uuid": "f8d4aa0f-277d-403a-8d7c-47818a180127", "value": "T1F6C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908897, "uuid": "bc64242a-b6b9-468d-a1b9-c0a057c994ce", "value": "3072:hQrFRNfuLrGhEPOD08g3gNlmBoHQuQekQnYW:IFzuaEGQ8g3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908897, "uuid": "aa85fcb4-8d34-4c85-a20b-878c7248e2ed", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908897, "uuid": "8318b63a-e338-4822-8014-0c8f32d58d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908897, "uuid": "03852e43-33c3-4be1-aa21-8ab5e228a692", "value": "4382584d1a20f4a5e126248b1321d6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c13d50-0c6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686937981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937981, "uuid": "f01765c0-c544-4f91-9ccd-3bae1a22a88a", "comment": "Malware payload (Tofsee)", "value": "4daa81a4c81f77214904365e80817993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937981, "uuid": "56ff438e-4a75-431b-bc25-692f210ddd4e", "comment": "Malware payload (Tofsee)", "value": "56dbde7b618fbf48d9c5d31512fcad8a8c371dc55742db61142b9a38cc8a7ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937981, "uuid": "590a4fce-5301-4411-93f2-609091454552", "comment": "Malware payload (Tofsee)", "value": "3d44bd36c7657703d19e7d28d83767940af6e14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937981, "uuid": "e0277486-4b6c-417c-bd05-7dadfb7faaeb", "comment": "Malware payload (Tofsee)", "value": "e8bc63041affb3739b0ff0148b3f2f62f8dfc0cc8b685dc4205c0a9532bdc3370f4b7c0c29d29c841d1672e2ca421d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937981, "uuid": "125246fa-4d68-438c-998d-74da6131496b", "value": "T1AA840903A2F27C51E5768E728E2EC6E8B62FF5604F59779E52149B2F04712B2C273721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937981, "uuid": "d2baa41f-d3df-4b9a-b685-ddb10db3ba17", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937981, "uuid": "e7f64321-3fcd-4ab5-b1a5-43ec15c131d0", "value": "3072:J3+RaTd+KZBWgF7eMRJ9QIPGRd66jDIq/QeGjEii1/k5pZwh5TQT4ej:LJQYJ9G0ZveGjU1/o0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937981, "uuid": "4d5c05f1-8280-48af-afc7-d8dc2693feec", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937981, "uuid": "ceff1631-f990-4dc3-b63a-81899763527a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937981, "uuid": "ac1ad42c-a14f-4062-bfe1-a974e2a7d6b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85790c76-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686925476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925476, "uuid": "754b48ce-02dd-4f29-9e52-e321be6bbbb3", "comment": "Malware payload (AgentTesla)", "value": "02f7c729e7344aad545091d1bc408658", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925476, "uuid": "9076db44-dfde-44ec-a662-f03fe406bb66", "comment": "Malware payload (AgentTesla)", "value": "5750b391f7520164d06daa0762ca20d8ce5ee97c335b06d2966098555069cc68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925476, "uuid": "74e3000f-cd40-4b7d-8b0f-023ff58296c2", "comment": "Malware payload (AgentTesla)", "value": "526b6336435336c2b146058b2ee0f13f2bc50868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925476, "uuid": "7a596645-29ab-4e1f-ada8-f8a02d8789e2", "comment": "Malware payload (AgentTesla)", "value": "a90b0465efd87cfc8c9982bbc0884eb41801ce3e7ec3f94c916c0c46b27d1e29d5fcb885fa347be470feb4fe877a0e0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925476, "uuid": "c7f48a9f-ce7a-4fc0-bd1f-43ac0081f1af", "value": "T1C454126D92D0C2BFDEB00B300E7EA64BBD790A62192C5A6707414F5E39B2D516E4F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925476, "uuid": "fada8481-0c1f-4615-9ed7-708daf53d3e5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925476, "uuid": "6b42deed-1841-4b96-bf18-991587a1dd25", "value": "6144:PYa6mjVxIVcFTzM8TLcarh8TC1EgeYrOIL4NeYynDGFnq030WrKm5U88:PY4pxIVcFTzVim2nTB010EWGGU88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925476, "uuid": "d4f5dc08-5a00-4936-ba66-c1c3be8fa1d9", "value": 290281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925476, "uuid": "1963f7fd-5c8c-4b37-9d83-7b60557d5ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925476, "uuid": "aa459fda-2da2-4c72-84c3-1d10bba86137", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29137d63-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686905994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905994, "uuid": "4bc6821b-24ad-40cf-8ef7-bae832c73f6b", "comment": "Malware payload (Mirai)", "value": "60203a0bb13da9913347263b573fba8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905994, "uuid": "8b5588af-6a5b-4ee0-a68c-cdda6cf5d681", "comment": "Malware payload (Mirai)", "value": "5965bc4a14035a748e27ac7882583975b168a1fd42a3ecdab6f01b11dd4d043b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905994, "uuid": "fda1ee12-6649-410a-8dd5-6e230bc45e98", "comment": "Malware payload (Mirai)", "value": "9a6ac8f442d7b9c5fc33ae420b61e88380aa2c5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905994, "uuid": "11582710-3de0-4cc2-a35e-b9524006a64f", "comment": "Malware payload (Mirai)", "value": "70e0cfbb20a3c32e6ac9f9b542a55ba11b8136620358cc89cc411c65de0bc645804131bccc59934cd7c237ea8c4c6151", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905994, "uuid": "3f2ab429-59f4-4735-b401-b02d5ca8c41d", "value": "T19CF2F22012CD38BBCE9209765DE705DB122BAD72E59D606E7F6023B967E11DF3EB0011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905994, "uuid": "38558a1d-b832-4152-abbf-b31a93daeecc", "value": "768:llpDuH355h9CulxpYCihih/KJ59CTSnjo7EptgUdBaXU3Um:lq5bFHpkih/KJ59CT4tgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905994, "uuid": "884ab318-8489-4975-a13f-d70b9a5fc71c", "value": 35956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905994, "uuid": "b77f6115-f7fe-4885-a77f-cfcc5eb99928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905994, "uuid": "a5876bc9-1ca6-4408-9e95-26258b3bb50b", "value": "60203a0bb13da9913347263b573fba8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a38abb-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897531, "uuid": "46e48534-8859-40e9-99ec-84928c54b0e8", "comment": "Malware payload (Mirai)", "value": "96bce03377cf44d043a7ee827a1b5bce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897531, "uuid": "580ca1c6-5cbd-4780-9450-de1bbbad61a1", "comment": "Malware payload (Mirai)", "value": "5af7161793d6438fc1d9ee70e73562b2fec6411d16fb5b0e1efe38e572e8e617", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897531, "uuid": "a0f07a8c-5747-4974-8b19-0d7c71379a34", "comment": "Malware payload (Mirai)", "value": "e72cd33c7a8c4a775fdc6944cb236a495a035506", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897531, "uuid": "06a10e54-3c0a-4944-b883-eabc8856b445", "comment": "Malware payload (Mirai)", "value": "7ce7c98f4d7f38bda01d4c37582bcfa21a37b5a4b92e10c075bf9622194a2279b70822c8f9c2626da36aad6885d096f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897531, "uuid": "78c0a6cf-55c3-4ff8-a677-9483e4641582", "value": "T1966301209610FC50C9A46335E03E9ECA5D2CA13B928FA76537FD86E56C99E438737F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897531, "uuid": "ef36b026-2bb9-44f5-a4cb-c7a77fa5c67b", "value": "1536:MBOy0NL7LCbHnS0CwpJYcEHqdCumwrTKLEppFieLHHP:zy4Lq7CwDeqdlKLE/57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897531, "uuid": "450ab27e-72ad-436f-bcff-d5e20fcc77fd", "value": 69820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897531, "uuid": "86b28d7e-49d9-4699-949a-ee18a81af44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897531, "uuid": "406dd7c5-7c60-49bd-8857-82f72b0ac3b8", "value": "96bce03377cf44d043a7ee827a1b5bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fc1a9e-0bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686882420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686882420, "uuid": "2b028aff-fde3-4306-a698-af14e9c9cab1", "comment": "Malware payload", "value": "a2f149d51a9e5847025945adc6a07a5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686882420, "uuid": "941a3cce-66dc-4326-af56-58c44c604db9", "comment": "Malware payload", "value": "5b3befe84651843493ad2526f1b1cb8628fcedc7479fbc4079671918ae22b297", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686882420, "uuid": "954c997b-a512-4e96-bbdf-7672fe8705b4", "comment": "Malware payload", "value": "6f7b92572737e939fc0e6cbd38eae3183cb6f943", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686882420, "uuid": "894e4af1-56f6-458d-ab51-3537438d0e10", "comment": "Malware payload", "value": "f3c3b12354b326a9687f4c0bab62b577e70ebec0e345556be00f575fdd44a70c9cb77170b020755daca296b31efb11b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686882420, "uuid": "662ce0b9-30a5-451c-8f9f-654fd85bddfa", "value": "T10464D055B1E0ECA5C4BE063E6C60E3EB823F6772DF00781B06166569AF783D05D63636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686882420, "uuid": "680a8b4e-5534-49f9-9810-428ed3b4eabe", "value": "8bdcbfa1a4d3bacf7d5e4d096aabe642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686882420, "uuid": "1ce76b17-b232-4325-baae-0b45a2958780", "value": "6144:J/nDfv9L/FCR5l0e0RXhJEVFwL7plM3GCROuWIi8y83t:J/nLrCRf0e0RXfEMo3GTuWIvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686882420, "uuid": "6a51d30d-df24-4da3-82aa-a5dbd1375700", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686882420, "uuid": "de6c55ef-6fbe-4114-8bcd-7d9d7781bb1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686882420, "uuid": "f3e43e03-129d-4047-86a6-54bd55f1ae29", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.6EAFB7F0.16244.15893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9db3539-0c31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686911927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911927, "uuid": "0566af86-8de6-43b7-8820-61f834ab4360", "comment": "Malware payload (Quakbot)", "value": "3d13d4d6d813a5a3a7efac946aa23f6e", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911927, "uuid": "16c4cad5-41d4-4547-8bc2-837f49126a67", "comment": "Malware payload (Quakbot)", "value": "5bee70d5cd916d0314f34509bfc652a8c42616caa320e4273059e694cca53520", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911927, "uuid": "c86580de-42ea-4d56-bf55-f8a4bfc8e022", "comment": "Malware payload (Quakbot)", "value": "919971c7d4c6dfdd5ea7efdf0532cbc51b683b08", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911927, "uuid": "be81b9f0-99c7-4fa4-9184-b6e9344a4133", "comment": "Malware payload (Quakbot)", "value": "fa81fb7cef657a3366a7d52b3262239346459d6e11e1b9efeb9cffe8353b0bde77d72809edccf9c71d74a720c6812793", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911927, "uuid": "5339fb4e-9ed2-42ac-b602-69fb0a697418", "value": "T1FCC4725AA7492474C073B33BDE5A8404F936172F2556891F7A3CA1E80F7982463F9FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911927, "uuid": "85e1951c-df73-4be7-a340-d0757b0a6a3d", "value": "12288:mWGJKxqUwYJpnwhdIhiZAwIQ4Cj8kA4dywL0u+p+fm3DB29vRQIXQrQHRtzggoj4:muZ9KCkHR5ggoo5vuDf2Ag//nt0n4GrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911927, "uuid": "b9623675-3f7d-4a61-aba8-60fe47d0bfa4", "value": 569519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911927, "uuid": "de2cd868-3765-439b-ae22-383ad3c17d99", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911927, "uuid": "5dbd86a3-4f15-4983-a255-f580f68f489b", "value": "DbNDJcSKpCxwE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11fb213-0be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686877956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877956, "uuid": "c39983b4-aea2-4bd5-af75-8d7f3e3ae3ca", "comment": "Malware payload (Amadey)", "value": "0af06af87ab17d640e1edaadcb4940b4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877956, "uuid": "0c55a258-06dd-412a-bffe-025de5e61969", "comment": "Malware payload (Amadey)", "value": "5c7944065f2c3efd10121154fcca53fdb90b246495568c542189a9ac3ddb8a14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877956, "uuid": "58729c11-81d1-492e-94a1-483a42e3f9a1", "comment": "Malware payload (Amadey)", "value": "097b8a627f828f3191707f60706684ed39139214", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877956, "uuid": "35612683-19f6-457a-82c3-b1cb9d51ada2", "comment": "Malware payload (Amadey)", "value": "a073286769260ce02956d5b889242d22f91fee50e6704e43b7f9f89d5969155fcefe535b1c06bccab925dec25b9ff840", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877956, "uuid": "ea6ad584-bd87-4360-a6ce-16f8198797f0", "value": "T169051295EBF88462DCB9237158F746C31B3ABDA31A38932B274588891872780757277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877956, "uuid": "9c0a4182-d6b0-4de7-955e-7e3e2ae76c73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877956, "uuid": "2e48f5f3-dad4-417a-842a-cbba6d88568c", "value": "12288:WMrQy90/7klHro1tFCE9+qHvCPuh5XZHeEXbzoRiLgPG6obyq6ak9o+7pU5rFMp:Cy8q8fHqGfXBRmimo4VjErF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877956, "uuid": "93a083ae-2683-4d44-b2a6-849690808854", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877956, "uuid": "16c5a2fe-0738-4e0d-85d2-0a973f55266c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877956, "uuid": "d64b9728-ffe5-4cc8-9352-ecc3213a0fe5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ef47a0-0bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686889614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889614, "uuid": "9b04ba99-c2b9-467d-8651-234cc2dbf3b4", "comment": "Malware payload (AgentTesla)", "value": "9006f205bcaefda27ebf7b1b46553b47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889614, "uuid": "7c506ffb-a249-4224-b10d-1f3aa980cbb9", "comment": "Malware payload (AgentTesla)", "value": "5cbb05d0b8c1b959f971e9062df45008cd0f24a545de69157863d7ee6a55b3c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889614, "uuid": "45213a74-04c1-468f-bd49-5eeeff64bc74", "comment": "Malware payload (AgentTesla)", "value": "59d24b2cef44f7177aa7d8240ffad4f2451e7e7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889614, "uuid": "d1c66744-9595-4d7b-bec6-2d937d5b52cd", "comment": "Malware payload (AgentTesla)", "value": "28d0f555dee73799d83f8b3b54af287ff0a01a95c67ffd5bfdbc433f524d586d601c112deb6b3a0e68144c020e50720e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889614, "uuid": "02a2adc5-17fc-4616-8049-bfe91a22b461", "value": "T157B45E6C3FC95A72ED1DD1B88A058A0DBB660F436280F993D7CB25CA875F4661DC7C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889614, "uuid": "4799339e-7732-4f4a-abdc-83a961c79b44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889614, "uuid": "e673a9ad-87f2-4821-b619-5af7fda0faae", "value": "6144:Mp8upWys6/lI6saFPoto3+15XVLtGjaJPvGAe6Jo4tIIWq0hZtIO5bMTpzYXS/IW:MjpVs0CKcrXVEoW4eNqQyt9YX872m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686889614, "uuid": "3a6bc1f4-02e9-4bd2-8f8e-16fcca28fdf9", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686889614, "uuid": "0d5d47bf-647c-42dc-9e7d-e64a87245a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889614, "uuid": "f3d1e864-68d2-4fd2-be0b-8ec4264184ef", "value": "SecuriteInfo.com.Variant.Bulz.738098.5497.24555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d91bbd-0c6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686937343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937343, "uuid": "30c344d0-6fe5-4465-bcec-66a9737a5fab", "comment": "Malware payload (Smoke Loader)", "value": "5e63935fdeca7b722c43e96018dbf8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937343, "uuid": "d9e8e509-5b62-4fbe-bcfd-a0e3b3523510", "comment": "Malware payload (Smoke Loader)", "value": "5d1e370e91781794b86ac4ff2bfcd901a2260af12a0fac13dbd4e93348f571cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937343, "uuid": "7cc4d4fa-3506-4b0e-b9ce-2ba9350f519b", "comment": "Malware payload (Smoke Loader)", "value": "96a0ca7d1c65b87af73948e49c6b7c998b04abc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937343, "uuid": "b2ecaaa7-bd6a-4f38-8ab4-bfe1339d5fc1", "comment": "Malware payload (Smoke Loader)", "value": "5961bfd5efd672e270ec4edafff97414f02e276f79575f184a02c3d2d07425f8c3b83a89f88c4c987280afbdaae97918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937343, "uuid": "99273878-3c89-49d9-9ed9-02a2fa56b713", "value": "T170841913A2F27C51E6768F728E1EC6E8361FF5604F5977AE92149B2F14702B2C263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937343, "uuid": "57dc639e-05aa-4197-87a2-05fb9585d79b", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937343, "uuid": "44331ea6-4011-4e77-ab99-e981243a6ed8", "value": "3072:B3OBfDduVeRWwFLu8xp95S9mJBioO7LKrcvyj+eX5YA5pOwh5TeivPl4ejW:yJQIp95jIndk+TsdBnvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937343, "uuid": "e82e2edc-527e-4633-b9cf-e9518cddace2", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937343, "uuid": "6453cabd-97c2-4ffc-a48d-f92c91b225dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937343, "uuid": "34177671-6ee7-4469-ba14-8061d302278a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4380086-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897637, "uuid": "3dc540ae-099a-4ee5-a28d-908907cf4896", "comment": "Malware payload (Mirai)", "value": "fa5b67c7c02e89f588f4b4b2e502c927", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897637, "uuid": "3f6ba1c1-1256-4c27-99b7-d142a4d229a0", "comment": "Malware payload (Mirai)", "value": "5df9118f75ae02390d125608d2022f770c03483f50e22a6a3e935acc0e7c912c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897637, "uuid": "d840fe89-9072-4f89-ba53-55c3d750ea41", "comment": "Malware payload (Mirai)", "value": "e344b5daac2a52997ff42055606fefd0ef84d287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897637, "uuid": "e093baba-6e36-4c6a-a754-2446ff025ed3", "comment": "Malware payload (Mirai)", "value": "0092243b819a6d58a2739e177c1662ef38d46443a6b92e927545b9351083abe9a25e621aebd56941002569b425e3f676", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897637, "uuid": "01961493-bd4a-44ca-a77f-77cd153b146f", "value": "T18DB2D09147A9B557C3F07475E17D8F924BB712E4E1FB32362910B22885C284F32BAED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897637, "uuid": "c6f57a71-5b59-424f-aaf5-f94f94b729f2", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVuK/lvRALXxRbg2Y2Yul8FY/OQthymdGUop5hup:4GaKQFH0rs3z1pJYzu+CBs3UozM71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897637, "uuid": "79524876-d475-4fb7-9b49-9ca984a18c39", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897637, "uuid": "d88a1ed6-db14-4bff-946c-908c481ac5f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897637, "uuid": "bd01d7a7-d734-4573-9f56-02df3c7a5d18", "value": "fa5b67c7c02e89f588f4b4b2e502c927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfce946-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908901, "uuid": "36b122bf-24cd-4d2e-b751-3daaad9924b4", "comment": "Malware payload (Gafgyt)", "value": "bd7059566f689269747bd9b9cafcb02a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908901, "uuid": "7c8637db-f42b-4f8c-9eb2-0db4bf7a1ada", "comment": "Malware payload (Gafgyt)", "value": "5e4a3a50d23b9ce12813321f14cde76f10a4607ebf0ff0b9bc46a038f429faad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908901, "uuid": "6d8e6d3c-ab9c-418e-8584-d3cf66accd17", "comment": "Malware payload (Gafgyt)", "value": "ee19b3a8991d5a877efd73c0867f815f03cb44e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908901, "uuid": "77686282-775d-401f-821d-6855bd4f67d6", "comment": "Malware payload (Gafgyt)", "value": "0d837336e2512a5bee8737de8691acd14b09f667708b7d8a3f0ba7db6249b170c35ba6a10d776474aa279da90be4e3db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908901, "uuid": "8f337d6c-d481-49ae-999b-a569478b63e0", "value": "T1C7C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908901, "uuid": "a2899d8d-5ed7-47ab-b8b6-b5277b4ec636", "value": "3072:H63VpNeuWDGeQf8sRC/t3DxkS2YmyVUQuiXfQd6W:OSuWQEcC/t3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908901, "uuid": "a70fbc07-ab46-4229-8bf3-73f074ddb31b", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908901, "uuid": "962989ab-2744-4b18-8c9a-c2a47512f960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908901, "uuid": "2cb853fa-99e0-4e21-ab55-a6f534d3cde7", "value": "bd7059566f689269747bd9b9cafcb02a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b08ed-0c0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686895284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895284, "uuid": "597da62e-afb0-47bd-858f-ce19450bb3d7", "comment": "Malware payload (Mirai)", "value": "c9223a03cbca7e0870dbd3d2eb383e27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895284, "uuid": "987a419f-1b03-4f95-9e9b-ef9fba46d91d", "comment": "Malware payload (Mirai)", "value": "5e565a9fce315f3c83b8915b9a30dd91a54f175c14888db79805fa4fbd645e5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895284, "uuid": "5194d63d-da19-40cd-b3f8-a26963a5b153", "comment": "Malware payload (Mirai)", "value": "3b3d0c0aaab50ba23a27c101aec7bd04cf76b68a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895284, "uuid": "e93bc380-c057-429e-9ecd-405cdef1a74e", "comment": "Malware payload (Mirai)", "value": "86f0b62d94118f71980e92be337b495b2a1827818d7483f20fd5b7679dd3f4ad269e36cc2f2e0fadd584692b930b5360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895284, "uuid": "a5eedf81-b938-4b2d-9f00-980b4ab4f01e", "value": "T104D243592D21DFEEF6ADC6304BB38E306398739126A09649F25CDA0D1F7020E695F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895284, "uuid": "5823e28e-b96a-475c-b1e7-f6980b5c937c", "value": "768:4XB54rI5zsloPYvcRZ1CdhlRJMac9SrE4BzS21E:CSoAvg2jlRd6qzS2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686895284, "uuid": "b21355cd-b345-467c-8f44-5ed46f88cb70", "value": 30336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686895284, "uuid": "0f09b634-4561-4a56-a4b0-ce9a1ec74d02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895284, "uuid": "85b8a3d2-8ac7-4afd-a242-173d5010379f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2e8bb3-0c0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897058, "uuid": "22a83f29-425e-4945-a66d-23a475d451c6", "comment": "Malware payload (Mirai)", "value": "557ae19a9a76709eb9fe0cdb63d14bf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897058, "uuid": "af56a567-8958-4bcf-82b7-c71ecb1343b9", "comment": "Malware payload (Mirai)", "value": "60a9bc9a9afddf3c2791cd283e99beec485da24f4913e4a80ab0e27cb926371a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897058, "uuid": "6378d9f2-a28e-4062-b497-acac36fce677", "comment": "Malware payload (Mirai)", "value": "ba830dad0daa4f376787381c11ec7b4440301f87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897058, "uuid": "64df4d8a-f667-488e-b615-953137f3a542", "comment": "Malware payload (Mirai)", "value": "a71328cae1d4f8ca33f196552c84a0f150732fd0ec6db7f50524fe7cf0d16ae604125d9c68014770a4ff586f60d927f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897058, "uuid": "ff1fc20f-53b9-484d-b063-7255ea521572", "value": "T168C2E051D8D9CD1AC06382BB191E14762028FE22474CF93E2B3E6B99A757865D33ECC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897058, "uuid": "849925a2-a14c-40b6-9d2e-4506dbfbe0fe", "value": "768:45+Kcrb9VDJehWr/N3OOCPMlSroYjneCa:Hlrb9vecr9OOF5YjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897058, "uuid": "03d528f8-b7ae-4408-9da4-7bcdfc02288f", "value": 27720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897058, "uuid": "0fdfdb54-4abc-468e-b11e-65d7aa262608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897058, "uuid": "1cac52c6-dcfb-495b-83cc-cb2fd558f6e7", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1be933f-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900317, "uuid": "95c8cf9a-0528-4c79-8182-1ec4c0fc0928", "comment": "Malware payload (Mirai)", "value": "3793df43afec8dc14754fc27fba985af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900317, "uuid": "7a5e702d-5a60-492d-8c70-82676665c6d0", "comment": "Malware payload (Mirai)", "value": "61136756f368822f0e3ae1dbaa455fb4aa70c79934e4fe7efd795b57d05b342d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900317, "uuid": "d0b7a1a9-1d06-4dc6-9cec-8d8a8c1284a5", "comment": "Malware payload (Mirai)", "value": "6b4738105d1b203dd0e3a79fdb4a965399af390f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900317, "uuid": "386300b7-4858-4944-abc5-313974e2dc98", "comment": "Malware payload (Mirai)", "value": "962a5eb2f805913d48251f54d3da650a3cd7cebb6931ff47d77f7e608262907d41a3809a78e75ca4c3946e9c6ab64f1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900317, "uuid": "a3687afa-408a-4b06-bdcd-f5bc49f48ab2", "value": "T1D1735B21B9392E27C0E0A53B22F74761B2F1574E35E48B1E3D760E4EFF2098425936B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900317, "uuid": "f93ecd03-ac51-4647-933f-816e92dda36e", "value": "768:DC7HyA5Zsof9ehs7n2LdKoaWMImJbPLVGOKKFTO+75jkaDjT1tZuFBIM3:DOHySyI9ehs7n2LdKoaVHhPp753tWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900317, "uuid": "7a0f386e-1009-4c9a-8124-2590977c2c9f", "value": 75508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900317, "uuid": "de7b57f8-405b-475f-8a1c-8c9dd5ee1d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900317, "uuid": "110904d6-ef26-4b91-a6bc-cbeb12b29bf9", "value": "3793df43afec8dc14754fc27fba985af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7164713-0c9c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686957852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957852, "uuid": "91b937e6-32b8-4d6d-8dfd-06dfa2d1e8c4", "comment": "Malware payload", "value": "6d0e06115140f3738ad91484dcd384fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957852, "uuid": "f824ce34-0eec-4a62-a015-fd29cc49dca6", "comment": "Malware payload", "value": "61e82301d812c2d2710dcd4900890e6c291e0e7dfcbe60762ef199e726b44212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957852, "uuid": "6b1dc06c-216e-4b8f-b63b-6cb6d1a46e49", "comment": "Malware payload", "value": "652f5cf71a9e906e5df82e2bea88593356df1163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957852, "uuid": "7d2a52c1-5e82-422c-9c68-cabf90eb6f18", "comment": "Malware payload", "value": "b710dfc584d3a327181bec9cc82bc31a41b02752ca6061651b6e4f64d55121456aa0a13ef9883e8751c6d7a6a5835e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957852, "uuid": "75de8ba5-b0de-4dcb-bef8-a63512b13d16", "value": "T107051317BBC48432DEB817704CF646C30E35BCA1D864822B2786AD6D4CB36C49A7977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957852, "uuid": "ac2d1d20-9148-47da-8866-26b0775e7fe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957852, "uuid": "3cde9e96-cc6e-4ddf-8816-d20ac36a5419", "value": "24576:xyJ2M2jV+ADzDUKZFV3LfPIR7blc6ksCKLCENf7:kJjiV+YcKZfPIplcOCKLC6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686957852, "uuid": "ae3ce1ea-50ad-4c16-8386-c538b1ac1e27", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686957852, "uuid": "6a974300-0724-4cd8-8e63-5404028606a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957852, "uuid": "7e0cb44b-322c-46d5-8f97-d27f5096107d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cf6622-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686914384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914384, "uuid": "7f775c4d-6775-4ecb-bf51-2023a5a72c0c", "comment": "Malware payload (Mirai)", "value": "a7cd137d935abd66b13d555def988aeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914384, "uuid": "0db75c35-8e0c-4314-8b9c-62bafe270fdd", "comment": "Malware payload (Mirai)", "value": "621f608ff38c35e12d03844f995f63251d5ab4acb665b19e3595b0de76ddf6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914384, "uuid": "088098c7-cdc0-4beb-be56-0a58be66b2fb", "comment": "Malware payload (Mirai)", "value": "404f4ddf09a65cfd44b96daecdbce9ec2a0854e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914384, "uuid": "201240de-6d7d-45e9-a139-ec99088a6f3c", "comment": "Malware payload (Mirai)", "value": "0b41b336664834ef809105b74cf209737c056d8f0cf6dcfeea4261eac23b77032e13e6e702409e7963d760efafc8faf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914384, "uuid": "7e9f88fa-cb0e-44d2-a1bf-ac560ae39337", "value": "T197A33931BA362E27C1C2A13B11F74721B2F153C925A8C62E7EB10E9EFF255402557AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914384, "uuid": "70ada202-550d-471f-8827-a15babe932f4", "value": "1536:qA+eQuPfwDQ1wD9H4PHgXSLToz8auQU39W9L+HRlM5ggtIpK0wbZn2T:nvScKSoAauQCQ4HRl8gD9wbZn2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914384, "uuid": "3174281f-5dcb-4a35-b1c3-a1c2f72bb44c", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914384, "uuid": "2e9d30e2-740c-4a72-9b28-9ee8071fa0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914384, "uuid": "47244883-43e7-4a16-a886-0ccca2c0a34e", "value": "a7cd137d935abd66b13d555def988aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94f5789-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900276, "uuid": "b846765d-1157-470c-bef7-511edf7cfc6e", "comment": "Malware payload (Mirai)", "value": "037aa15f104edda6eae9e401eac8bfaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900276, "uuid": "ddff123f-5d34-40c7-98e1-fa0e1e132817", "comment": "Malware payload (Mirai)", "value": "62cbb8cf013d120052ed2cb8bb7537b005a6834aacdc5aa79f6b93fa9318a059", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900276, "uuid": "0378c42e-8fdf-4ec6-bd54-1660ef7ebc89", "comment": "Malware payload (Mirai)", "value": "1372821fb67267693f60b358a2995b65ac55b8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900276, "uuid": "377f8a6d-1899-4ca8-9dce-4f2ebecba47f", "comment": "Malware payload (Mirai)", "value": "3b87a036692fc8b3b78d126fb16aa76ea84d24ef7770f84c36b9dceca55569c1a28dca96e289c9750a3afcb9c65a0362", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900276, "uuid": "0875d848-96fe-4667-94cb-3d87831a354b", "value": "T127C2E12293115961F63C8D3D93F1898FA6858DBCE158B1B0255807783AE221F17FADEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900276, "uuid": "28d4ad4e-1da9-4fd6-9cdb-7793a97d196d", "value": "768:znqMLBAn0noCR2url+nDql5Zfh630N/DGl1hs3UozX:+M9YLCR3rlMeB63eafMzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900276, "uuid": "bf809e7a-937e-4254-b0a7-bef69d12f119", "value": 27320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900276, "uuid": "de074f75-36f0-4980-ba51-fd429d7b6572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900276, "uuid": "dd402fee-ce13-4cda-9949-56cc7dff1478", "value": "037aa15f104edda6eae9e401eac8bfaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b861c6d-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686876389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876389, "uuid": "7dbb7d51-f21a-4e0b-960b-3bba8520b0bf", "comment": "Malware payload (Amadey)", "value": "4c187250087e5312f8e87527b1b99141", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876389, "uuid": "c7629403-e2a0-4f3e-b589-4791c4f8e7da", "comment": "Malware payload (Amadey)", "value": "62df74714cd81842088313cb600f935d37a851b7faffba085303346877ff2a9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876389, "uuid": "09c2b38b-7c30-4847-851e-58f8977a1ee6", "comment": "Malware payload (Amadey)", "value": "c7c5ea811f6fec0213ce8f4d883f7d19f3ee0053", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876389, "uuid": "b4deae6c-2e50-4db1-8b79-7af929f3e727", "comment": "Malware payload (Amadey)", "value": "9465bb3473f32a5a6e0633451d81e36fee7411a38d3fce2fad2e146442dc8360aecff690109631b4002d88cdc9c91a04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876389, "uuid": "75d6fd48-b4dc-4d32-8cbb-2d7eba4d91b4", "value": "T1B126EF941D5CD862B37A0D6BCA169EE49A6B74DB3F3A0981077302665D91FF0DCF208E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876389, "uuid": "6109c21d-ca34-487b-aeb4-8905890d88ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876389, "uuid": "de3e9da9-783e-4bcd-9ae9-8b5704cd7bca", "value": "98304:7qQYrAVefSKOxbI7koS64IGkBHtyTETlKuCWxJAg25J0z4TuJgD6UHMLfKZ:72wowmZyEElzjY4TegGUHmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876389, "uuid": "6460124d-8aff-4a09-bd84-87be0285cc81", "value": 4850688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876389, "uuid": "92ab03df-fe36-457e-ad98-fb104c77cd2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876389, "uuid": "a1b09018-5485-4606-a158-0ce34acda19f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666a9264-0bda-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1686874314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686874314, "uuid": "52d06335-a426-49ee-bcae-7a3e1b717a03", "comment": "Malware payload (DarkCloud)", "value": "a616af52b054a6f9e4eedc9aa9fc7f7a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686874314, "uuid": "99b268d6-6455-4eef-85cd-8d3d34610ba5", "comment": "Malware payload (DarkCloud)", "value": "62e14feb0e0a4b6b36e258f63af59d4b68809fe0761b6c58c7ecdea90f4f2c1d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686874314, "uuid": "431f4e23-dff7-4a97-a127-3d9bd38ea9eb", "comment": "Malware payload (DarkCloud)", "value": "1c7723b344fd9b2d05bf3652ba50a1001a81169a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686874314, "uuid": "e079860c-a40e-40a3-8377-f0752d92c4a9", "comment": "Malware payload (DarkCloud)", "value": "3305d590043a7ea817de00107210d7767bda30fbf77467144b73def4653cb9a80dddf5384f98b5cb25d325f083a36a9e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686874314, "uuid": "a52ae915-5aa4-4a46-9b7f-c1a03dadd4ff", "value": "T1AD9423101660C86BE6944EB10D750A7B8FF5EE273194DB4B43607E097B673A7DC1B3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686874314, "uuid": "3b123de5-aa86-4b64-afe9-a7731ad36728", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686874314, "uuid": "b2049005-7578-4b7e-8138-05f0fc3bc1b5", "value": "6144:PYa6DMcTSSi9XEDajxx3lLckOpJJUPlekuT9T3wHPK7Yqfb4lB8P91bgHGLqm33:PYhMcTSSi9hlLckOpK69Av1q0ILH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686874314, "uuid": "924c96e8-4924-4d93-8f26-f391b3a5d375", "value": 413372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686874314, "uuid": "db00597d-570a-4e43-a093-9525ddf7ab6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686874314, "uuid": "8b85e145-32b4-4b2f-823e-1ed18e44f952", "value": "LIST OF ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45adf6ac-0bdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686875547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875547, "uuid": "0d6f00eb-4ec9-4d93-91b0-68d14d4f7a4d", "comment": "Malware payload", "value": "7bc43411654aa0a415151dd620e1316f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875547, "uuid": "6cfaa6ec-d0a8-4cdf-a79a-43aa7a130648", "comment": "Malware payload", "value": "63ff6a04ce994b03c010998aeccd73a06219c7f420ad70fa6243b9aba6e34a31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875547, "uuid": "91a145f7-c72a-4178-b465-2c9f1dada5c0", "comment": "Malware payload", "value": "517dd9e10e51a3c0d3f4028037656cc4d5c67f1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875547, "uuid": "03a08c37-0676-4010-9b14-bd23a7629962", "comment": "Malware payload", "value": "0133bad8373c595b553bc83dd726c2f107dce937afaab06026d64aa3f368ac745f8f94ab55e4c6a60292d3a85632381a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875547, "uuid": "50b37f7b-6560-43c4-b4fb-de22ff53f616", "value": "T1C164D036F4D46869D8FEA53C4C20CBE7472FF972CF00799B124965690F3A3806E5B866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875547, "uuid": "765295a6-9b53-4153-9ede-6a60945d78a7", "value": "8bdcbfa1a4d3bacf7d5e4d096aabe642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875547, "uuid": "8fceab8d-5855-4a6c-8a65-7431a2e2aad3", "value": "6144:K/nJfv9L/FCRGl0jX6PWsX3jMU5nfc0agc2jD8TMnRlwQ:K/nZrCRy0L6PWsX3hqgND5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686875547, "uuid": "910d44d3-32f7-4d86-8bb7-4db427164314", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686875547, "uuid": "beba4d4d-267d-400e-9985-048b25174b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875547, "uuid": "078fa5c0-542c-4f1d-91d8-12e414b3209b", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.13AE7AAD.23805.8574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613e5c42-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686914248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914248, "uuid": "9cd2c798-1f4c-473e-96cd-4bcdcba64bfd", "comment": "Malware payload (SnakeKeylogger)", "value": "5d2860c831630b16be00984eb0ae54d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914248, "uuid": "cb3073ae-095f-4faa-a9d2-a71a92d5cb90", "comment": "Malware payload (SnakeKeylogger)", "value": "654385028b87dbf8e7387cd76dc69099cdcc344f97dc735647d429d11f7fe95f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914248, "uuid": "798fb61b-93dd-43eb-a2ff-37e2e2bf4086", "comment": "Malware payload (SnakeKeylogger)", "value": "b26cbcca023f1f99a459235917f2ba2d121a7dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914248, "uuid": "aa3f522d-749f-4b3a-97ee-2aa05873a801", "comment": "Malware payload (SnakeKeylogger)", "value": "96b8b4509aa562cbcf395e9be6d4dcfd791e056e00ea61082600ec0300d135b9aa7714a43df9cd012b83839f181bd1bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914248, "uuid": "8c074537-6a56-4a1f-aa88-64542eedcf8a", "value": "T160F4021062D5CF1BC07F0BF685501631877A6259F672C31A0DC274EE5E92BD3A29BB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914248, "uuid": "a6b08843-01a0-4515-a03a-80f2bd34ae8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914248, "uuid": "7c7ecf92-8434-4264-9982-bc7695aee734", "value": "12288:ANKDooa2iNx5LbzIu9+r9ZFJ7nLRTRkkgE2w1Ow3yDLQhy2qBI0iK7PzUXoKH7:VDRa1j5LA91TV9ngK1OwILmyJI0xHU4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914248, "uuid": "5de6078f-8d57-462e-b851-56066917f666", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914248, "uuid": "a3b05d7c-7eaf-414e-8bf9-417703b92545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914248, "uuid": "f700f154-73e4-43d5-a27b-02c9a9428d00", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962c8702-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686894580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894580, "uuid": "bc5ea499-40b4-48dd-a3d7-c294a3769927", "comment": "Malware payload (AgentTesla)", "value": "947477f28c6e19a24ea37c7cf037bb11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894580, "uuid": "5fdf3103-5ed7-4d7c-8d50-c49bf3178aac", "comment": "Malware payload (AgentTesla)", "value": "65672bd232f4652dfb914a74e9510ad383a8f8fe9884873cc885a61160610965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894580, "uuid": "82bed12d-bf21-46ea-8a7d-17aeab3ff588", "comment": "Malware payload (AgentTesla)", "value": "667a6477d86620010d48d6cbd479d18afa7fcd64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894580, "uuid": "13d41d48-f5cb-48ff-b86c-7926e1b81c1e", "comment": "Malware payload (AgentTesla)", "value": "ae2a59eb348cbe99fc51405b3f7b38eb26fb6b625c582b77e1743e9c080f3cf182f1bf9bdde85429aa092821987aaad8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894580, "uuid": "4a1cbdf4-e3d9-41f1-a651-986dc1ce77e4", "value": "T1D4541210729CCD9BE4A206717E7B1BBE4AF26616207CDB4F47D0CE8D7E15222EA1D760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894580, "uuid": "208fdfb4-c59c-4fbd-90a0-7e4986953346", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894580, "uuid": "a6c97d31-845f-4ed9-bba3-fb4d435c9e8a", "value": "6144:vYa6M/NbFQ+ADrHWQlnha3Rpa4jqQQNU3KzVz10OOTTAOmgJLG:vYaVbbIvha3RpJzUr70OCMOmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894580, "uuid": "8380410a-413d-47e2-901c-7805596f77bd", "value": 291214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894580, "uuid": "0a495f4b-24d1-4c74-a960-1904f33ece00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894580, "uuid": "3ef90b3c-b057-4b49-a085-87edc8ca4252", "value": "Urgent demand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cfeadb-0c73-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686940189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686940189, "uuid": "137434c1-271e-4828-9c86-3a13cb47ae12", "comment": "Malware payload", "value": "8f9ef3b28d9beff1a36974ba32e55a3f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686940189, "uuid": "7d9ec481-829d-4cfa-898a-7737eb513d74", "comment": "Malware payload", "value": "65d79068346b43894d6c000bc039010a741c475ca405135624b4d511efef9f53", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686940189, "uuid": "734567d8-1f50-4488-b760-b13312734625", "comment": "Malware payload", "value": "98081320282c5a5963aca803abd197ee401d6a55", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686940189, "uuid": "29c0321b-e386-4280-ab7a-7b9f6936a83d", "comment": "Malware payload", "value": "1f22ea6619e5cc9386696b681e6a11db461e1a74e3390c0636b7af201172c108565f6e2bd4c4a0a71ce8597cde602064", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686940189, "uuid": "27b19b97-26d1-45ea-903c-5d6f61833b50", "value": "T1A71309F152C095E4EA8BC21A553CAB785377327FABCA15C84166E3C47B7B7422B0CD89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686940189, "uuid": "d465ada6-8979-4d9e-9ad6-2b84668dc823", "value": "768:saimQKqbBMI/54KTfpgKW6O7L3ATXy2tt5dcD7v4FA/H:sTFvp/Sipg56O7DATXyuiDYA/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686940189, "uuid": "48c8bccd-5a64-4ff9-846c-4f3e94d33bd2", "value": 43834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686940189, "uuid": "35303347-9628-46e0-9e16-9a12c17ab1ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686940189, "uuid": "f1d963dc-c428-47d6-89a4-3471dc0a5203", "value": "image.png.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d649d7d-0c91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686952816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686952816, "uuid": "e22113b3-72be-45a5-a84d-5507b47b336f", "comment": "Malware payload (DCRat)", "value": "a27ecc305ca849d1d55adfe8886598dc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686952816, "uuid": "6d14257c-6350-43b9-a46f-9dedf401f4eb", "comment": "Malware payload (DCRat)", "value": "680f3d5c0153dac5fe27669a9555bd3baacd4d8568ee118cd6805f838e6a418b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686952816, "uuid": "65b79501-3dcc-475b-a365-4af1463b0646", "comment": "Malware payload (DCRat)", "value": "b67d1c5cb2ab30fb2f68da1aa4688f33b3a960f8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686952816, "uuid": "ff01c9f3-dd41-409a-9d73-235e5484bf01", "comment": "Malware payload (DCRat)", "value": "a582f39fe48f0d5820b3bcd5eeecaa988bc7bba9a358ab7aee40880c841f7333fd135e3e08f5d222b53b64e119d55057", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686952816, "uuid": "39e1b164-0b32-499c-99d6-d1a11df55cf5", "value": "T1AF646B1437EC4B29F1FEABBAD4B3515597B1B85AEA3EEB0E4D8150D91826340DD00BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686952816, "uuid": "332f96a8-e1a0-4f71-a1a3-6714bf2e787d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686952816, "uuid": "58e1d162-5ab3-4eb3-9815-b4cac821acd7", "value": "6144:XjyyN3U5b/cbkST2t8GjvzRY9b22qA9frJDuL45oubwVwCqy:XjNE5bM2tjY99frJDP5ozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686952816, "uuid": "33585314-ffae-4d45-aa15-bab8aa43b73d", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686952816, "uuid": "89adaa55-2286-4cb9-9e58-0cf12adef74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686952816, "uuid": "536cbcfd-ff09-43ee-a865-3d20bf103175", "value": "a27ecc305ca849d1d55adfe8886598dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6def3e89-0bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686888929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888929, "uuid": "9eda9700-f374-445f-95fc-67c8009fcab0", "comment": "Malware payload", "value": "8c76e949a6b3bfb992ceb54c3be68f69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888929, "uuid": "f21f24f0-5b07-429a-b9d0-99c342f3314a", "comment": "Malware payload", "value": "682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888929, "uuid": "f2e8b4cc-b7de-4304-9fd9-26b36422e358", "comment": "Malware payload", "value": "32892363bea5d921144baac2017e4ca06ecf8269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888929, "uuid": "0c4bc5f4-5f02-4f57-baef-29988074489f", "comment": "Malware payload", "value": "99c94e2a1920e231f5152ca316d6c3596eaf891418a3213fb5eb1c3a2a5f4e95a39cbcc45cf142fb364b526f67dd61cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888929, "uuid": "5a33db8a-d1ae-45d2-a9f8-76d5dc06d79b", "value": "T16E349E12EDF0AC32D625DB728D6EC6E43B9DFD508E14679B22287A1F1DB01A0C572379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888929, "uuid": "2749ab09-5166-4e6e-a94a-e3a68e8b1483", "value": "99ae33530ebff97e88a1ac2c3129a9f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888929, "uuid": "113515f8-87b9-4389-8862-56a1b065c14b", "value": "3072:Vlbprkr+kEzf417cGwQyd79mo3VCLtcnxS/s0bQc2poHFh:nbpQr+kwQ18hJzVW+n40poH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686888929, "uuid": "7cb59253-fae8-45fe-af94-a1fe672dedcf", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686888929, "uuid": "ead67b59-5efd-4801-8aaa-706d60d33673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888929, "uuid": "9b443094-c0ec-4372-8842-e56adfed4c43", "value": "8c76e949a6b3bfb992ceb54c3be68f69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89936b80-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897566, "uuid": "8a264174-bedb-4159-a08b-9c886a7ef4a6", "comment": "Malware payload (Mirai)", "value": "bf11dc761334ce3c7c1f7ea9c0e945bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897566, "uuid": "6ae399ca-a866-416b-85f3-fb7f8d9d17ee", "comment": "Malware payload (Mirai)", "value": "688e5e5e760c426723c1f89aa5dcfd69a91dc33078690dc3cfac60ef2b6e5402", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897566, "uuid": "16771aaf-79a6-43bd-9e54-07a08eac4c97", "comment": "Malware payload (Mirai)", "value": "cbe1ea979b98eb190f47d15c0c977b438671dabb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897566, "uuid": "cafce2af-ae5c-47d2-9151-ed8d2f3c947e", "comment": "Malware payload (Mirai)", "value": "e84bb45fab8f840ddf9782ec0c1cd8e5ec64d1c7f0499333acf66d5715df0a83c4cc528b1be2d59a5516a972a7812fda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897566, "uuid": "56a802da-5b33-4ac4-bafa-a9bad241a09a", "value": "T1A6A35BA6B4408C7DF84BDA7A80220609B531B3540F530F2B6767FDA7BD722E4985BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897566, "uuid": "8edee944-9b22-480f-9a6d-968cdd1f14fa", "value": "1536:SKA+I7OkDnCOIk0TyhFgDuIEKd2s065834VM9i52mFRr8TX+F0AgCrCJ:kTx0TyhFgDuYz06qY52sR4cgCWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897566, "uuid": "7cb98589-382c-4692-b358-9f4c3e1d9f58", "value": 101072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897566, "uuid": "82595b55-31e2-4cd7-9925-5213e94fdf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897566, "uuid": "5c7ceb8b-ed2b-42aa-8286-b063d373ccd9", "value": "bf11dc761334ce3c7c1f7ea9c0e945bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461bf527-0c5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686930094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930094, "uuid": "95bd6b34-f487-4587-8762-ee4dd3123d26", "comment": "Malware payload (Tofsee)", "value": "b034109931772f7df497ec4c48f3ab27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930094, "uuid": "0a737b7c-8e9c-4b15-9489-38ca939af66f", "comment": "Malware payload (Tofsee)", "value": "6a7617fd58c290f419bd13947ac35d737112a4f504948b59ab4c5e1f0dee8345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930094, "uuid": "152ab109-29a4-46eb-a436-ddc17bee47a6", "comment": "Malware payload (Tofsee)", "value": "0f797fda93e49055e91575c31819b0064f7aff54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930094, "uuid": "5e174101-6ad0-4959-87d4-a7338a51e898", "comment": "Malware payload (Tofsee)", "value": "a20b4702b1663fbc4487f38f2c0c95fae0471fad9b9a4d9b9f524236623a1681b0a4affabe5a936023ff6924102d47e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930094, "uuid": "7453f101-b8c2-44a7-becb-c998c1a00070", "value": "T1F5841903A2F27D51E6768F728E3EC6E8361FF5504E1977AE9224AB2F05711B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930094, "uuid": "bd1e413a-de84-4d2d-aeb4-917e688fe106", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930094, "uuid": "7608655d-e82a-49ef-91f2-cf0352fa1b4f", "value": "3072:o3KGhH+8pGyZWjj1LBwBQBOgKjUDo/ms4TypkBg5nEEqY4jQc5pCwh5TuFZ4Gj:94vOGBDgDkOnypkBQtqY4jr5BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686930094, "uuid": "05c44e08-dc6e-4140-8ffd-d77f615f93a5", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686930094, "uuid": "895fb7a2-3441-4211-a27c-b8ef04c63456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930094, "uuid": "64723465-2620-4381-9491-a842b3183dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499bc2d7-0be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686876843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876843, "uuid": "c1503f21-75e6-410e-9287-a7986cef5a33", "comment": "Malware payload (Stop)", "value": "f53618fb05d8b84c6570066863acd497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876843, "uuid": "556dbe92-340f-4527-9f18-5d8a10cf28c3", "comment": "Malware payload (Stop)", "value": "6b19297abef46d4f8bb61b7680801926adf41b0b972d733361c79d4fa02e616c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876843, "uuid": "3ca2a5dd-d19e-4faf-a2fc-c2bf9b9febd5", "comment": "Malware payload (Stop)", "value": "941e1724fabe7baef94427a21283772b13af61bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876843, "uuid": "d6db1ef7-26ae-4cd2-bf28-59fcb0d8fa54", "comment": "Malware payload (Stop)", "value": "9d2fda0ee1df084e13fbbc0c459dcc8473f2cfb194b02e0f06991420fc0ae836bb410dd3628d7d76d7c50c5cce8f5c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876843, "uuid": "d6895446-0f96-465e-bf32-4718934d7d63", "value": "T149F41212FDF06C32E5519B728E5EC5E5771EFE618E2067AA221C6E5F0AB0190C973339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876843, "uuid": "186cac60-00d9-4748-bfd5-e8e4ae4956ba", "value": "99ae33530ebff97e88a1ac2c3129a9f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876843, "uuid": "435d3ab8-c4fd-4e49-b663-13bb129c81a4", "value": "12288:V/5e8TGmEQMDUve62GeuAyZLfkQRliIf8BEMhd9LDuxny4HoEioC:VIwZvF2/uABeldHMn9/v4H0oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876843, "uuid": "6708f15e-ffaa-4f4e-bcca-a82fe5092258", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876843, "uuid": "34f0e4e0-e8fa-4550-9f01-88dc194197ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876843, "uuid": "b9797437-0f47-4bb3-9ff5-cd212dceba38", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22255796-0c5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686929175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929175, "uuid": "10773ee6-5d5e-4bb2-be8c-0085d36f4c19", "comment": "Malware payload (RemcosRAT)", "value": "1766579f9e1dd98f5fc8cdbaab8d8fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929175, "uuid": "baaff372-de25-4e2f-b9a9-05baa58d4953", "comment": "Malware payload (RemcosRAT)", "value": "6b4876ee9375a56d9e126297304cafd25639be66cdd3947e36256edbd9847e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929175, "uuid": "db640584-ad33-41fa-817c-38d2dc82409c", "comment": "Malware payload (RemcosRAT)", "value": "9ff67911e49e85b9a63edd41fbdd984c928cfdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929175, "uuid": "d98fd2a6-2ce8-46a4-b6e9-11e82951e694", "comment": "Malware payload (RemcosRAT)", "value": "6765c54715a1351d328271654a36208280b761e130f37b58a0c5f0bc2a4b44081ba12bdbc93754c42f99ba5946568fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929175, "uuid": "b5441f82-9816-4d14-bb7c-016e6be66053", "value": "T16BA3C0D63F687102EED31F3096DA4B33DE71B2E19FA085A629B9C42B19473C1766502F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929175, "uuid": "cb857c7d-9cf3-4b9d-ae4e-d8d18d4a6c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929175, "uuid": "956712e5-03b6-413a-9358-27d33595b3e6", "value": "3072:tz99788e3ijxwKXFOA/80pFhJgjaG13qDEJgjaG13qD8:t08eyjxBXi+jmJaEmJa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929175, "uuid": "978711c4-653f-4f3d-a8b3-ae56ee5d0b8c", "value": 106272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929175, "uuid": "f5dd5cff-1575-42b6-bfe4-005c2cc5d1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929175, "uuid": "de16db81-4ee1-4d64-8b4b-537689b1c652", "value": "Purchase_Document_Specifcation_i98576-FILE-GRID2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b68ad6d-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1686914104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914104, "uuid": "a7147b2a-7a43-41dd-9dc1-7556d1aa2e74", "comment": "Malware payload (Vidar)", "value": "90c4d8c8f396f66d9b556ab05344a8cd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914104, "uuid": "da024040-0982-41f5-9d19-06d0112d2cda", "comment": "Malware payload (Vidar)", "value": "6ba3d50f87b4c2c81a8ab9247f2fafa6f4ec31d1f3acffbdb40a83ab351df9be", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914104, "uuid": "db2e3cfe-2413-4bfe-8a21-1554b56c523c", "comment": "Malware payload (Vidar)", "value": "4869f0a7a3a68f4638556e9df0eef34ea0fdc9d7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914104, "uuid": "2283c11c-3b1e-4485-b383-9f1b54398115", "comment": "Malware payload (Vidar)", "value": "a458597ba0212ad2d1c8c3de1e110593b21d0a526448ab7cca6f56098321dc870bfe7c8f055c9305cff1487be3b4d368", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914104, "uuid": "eb787924-a494-40b4-80b7-57d8c86dd748", "value": "T1CC93380A76D560F6E8A9437484E343A3AA317CA15B8916FF12D0B6FDDE332D17531A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914104, "uuid": "34408a59-7013-4f70-b14f-23a7b3289272", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914104, "uuid": "19dc49c3-4f37-41cb-96fd-ade42de64e45", "value": "1536:Irae78zjORCDGwfdCSog01313OQs5gcURDoq4OZZZLlCIibQwfclq8wJ:AahKyd2n31+Z5IRD68wbQbl4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914104, "uuid": "7cfceb5b-029e-433c-bc10-2a44eaa7c456", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914104, "uuid": "4303cf0c-3ff8-4eb4-80c1-6220ec998275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914104, "uuid": "199c4d37-6976-4e49-bde4-c6ef6c9654e5", "value": "90c4d8c8f396f66d9b556ab05344a8cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76b6a22-0c93-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686953987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953987, "uuid": "aea456dd-da9f-41c5-be02-59efa7c67f2d", "comment": "Malware payload", "value": "4bdbe76d55d7adbd3126bb562a07648b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953987, "uuid": "0ab75d9c-418b-4f4a-b960-eb77bd84f9f3", "comment": "Malware payload", "value": "6c41c103968436997d3be866635033edebd1af7e6d6bb979e21c1725b3afe74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953987, "uuid": "d8840f80-6c4a-4217-a1ab-500c686aa7bb", "comment": "Malware payload", "value": "9140d4cf3ee8c592503d22c0bbefcadf52180037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686953987, "uuid": "a8ad4c80-7980-40c2-91ba-e75e4bf721f1", "comment": "Malware payload", "value": "1e8593ac5b1a1eb090854a4b13b05064600fb2ec3ff24da88f35ece64ecc841fe5d641ae172fa796822380ef3456b60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953987, "uuid": "5330953d-a76e-43d1-83f0-c5ddea4d4ed2", "value": "T16AC5336BD30054A4E034837874239E2DAF5F3C76A07651283ABB75952FB76F38467A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953987, "uuid": "39a108e0-ddfe-464d-a45b-37ac01617b21", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953987, "uuid": "f14bc3ad-2946-490d-9730-592ad4ac482b", "value": "49152:U6d2nGzEr3QORC0hWVzUbIgtznd8Vq9F+SXhX83asMxyH5flT1jenwDOZ:jd4Nr3PRC9gtznmVqu16xSf15DOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686953987, "uuid": "516c52b4-a32e-4eb1-a252-23efbdd36723", "value": 2634533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686953987, "uuid": "fd048541-6f3f-4a4f-b7e8-418d97b6a9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686953987, "uuid": "b134d838-ebd3-4dfe-8cfb-f4956698d897", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd412808-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686906296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906296, "uuid": "67eb69d2-eaa2-4e51-9397-ad4b13b0c970", "comment": "Malware payload (Gafgyt)", "value": "84daf613131031bd5d56a0172004fc08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906296, "uuid": "ea836756-9932-4940-a858-6354df96fcae", "comment": "Malware payload (Gafgyt)", "value": "6c6975fe8418b3de84880880c55013be3eaf7dc44280277bd9fabfd89e0c243f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906296, "uuid": "5ee711ff-392d-44e1-a0ec-2422772c89d7", "comment": "Malware payload (Gafgyt)", "value": "39db4af29bd4d6097a7cd3531b6bf526a2196718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906296, "uuid": "4aa1ed64-bd39-4cab-9bd8-811eb4b110fc", "comment": "Malware payload (Gafgyt)", "value": "611ad28c32f9311f7f60cbb49ff33b0b20d55199c71ab243fc6ba2e3ccf47621a7d54d232a569af98d19ba54fe4ce689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906296, "uuid": "121a1939-c70f-4063-984c-e287dbcc242b", "value": "T18EB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906296, "uuid": "ab465ad5-1dd1-4a7f-981e-c2cea9bf1e97", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPkJmDk1c8xF6KjW:jfO8IBpJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906296, "uuid": "2b546912-2006-4cf3-8f52-f90e82fee7e5", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906296, "uuid": "ffe4a53d-3876-4fc0-984e-4d3edcbd2bff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906296, "uuid": "40e6d808-627d-41b5-ad71-2b1cc2cddcf0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0caab94-0c26-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686907107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907107, "uuid": "8f2a2e08-fb66-45b3-84a0-d1b5d3f744b1", "comment": "Malware payload (AgentTesla)", "value": "f2e68caa5fe04fe78507772c6d1bf53c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907107, "uuid": "c82a6f76-31ce-4ebf-aa18-1ae6b42818e3", "comment": "Malware payload (AgentTesla)", "value": "6d23d4a7bee5819466b76d973037dbce4838f887a5333210f1cce118c2a4cd4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907107, "uuid": "e86edfa2-2523-4f7a-a199-173ccb0fec87", "comment": "Malware payload (AgentTesla)", "value": "abe93ce5fa33b7a1dd89552211c913de97461bcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907107, "uuid": "aa975dca-b837-4b40-a76e-dd2f2c1627fd", "comment": "Malware payload (AgentTesla)", "value": "73105a023dea9815365a0a00152605814b2c7abdb1ea03dc2a423ac225c79c49a00ff7966dfb0ee52c2db7da113a10a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907107, "uuid": "e3394d18-a7a2-4195-8f4e-4ee81daede0c", "value": "T1CC5402456220C0ABE97327336E778B525FE8D51325309B8B83205F5DBD6A702DA0E7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907107, "uuid": "63ac24c7-9604-42da-ad7f-afd72470eff0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907107, "uuid": "e31c0044-a857-4f73-9a88-136e90350be4", "value": "6144:/Ya6xmsR0dqHgxO8CyMfQITx2SCnPh/M5+kHuTT:/Y7msR00HsOXyMJ92SCnV4iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907107, "uuid": "af6b0d4f-cc53-4360-b766-f83f3fa299cb", "value": 291002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907107, "uuid": "fe0f5eb8-e7a4-41cd-8d5b-b8da822ebef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907107, "uuid": "78f597ae-4675-4c22-ac68-21c3883f7781", "value": "Urgent Demand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dba32f-0c41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DBatLoader)", "timestamp": 1686918635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918635, "uuid": "bbad4b9f-cb06-4d9b-9172-87492ceb6c50", "comment": "Malware payload (DBatLoader)", "value": "53bdb199af735b9313dd8940291c9e31", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918635, "uuid": "16c8d9e6-6f35-4ca5-9a95-416358a82a12", "comment": "Malware payload (DBatLoader)", "value": "6d6605d6a6edc9c58f9d8d7f92ab64261f3fedf32400cf353a6b69d89df0f2fb", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918635, "uuid": "e8bf8bb5-0030-4903-888a-f183b2d7c3a6", "comment": "Malware payload (DBatLoader)", "value": "fa69f356acf41c40eb851cae73226fd108e8e27b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918635, "uuid": "01525c61-880d-42e5-8bc4-5d8c84ed8862", "comment": "Malware payload (DBatLoader)", "value": "167adc9dd3273fc8cffedcfe213467612acd6471817a1e8e01fbd5d91a7f3ae38122d23d058863692a18d5de2af5b824", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918635, "uuid": "67129150-3f51-45b0-959f-d81ed6cf1311", "value": "T115058DEEA3C2C437D87223780D4AA395642A7FA02D58F447B6D43A9CDF3E5843919397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918635, "uuid": "0d15f2b1-c425-49da-970c-a79c42a7a5ba", "value": "37795b00317f02deea74012e147ddf7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918635, "uuid": "8012bc09-0b2f-4f47-bb62-7a05d963a262", "value": "12288:RElktyzweXm40fStl4/ukRiZLTJ3r1XmXmF8KMrFiojZV:R0NweXJj4mk4TLmX48KMrFioj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686918635, "uuid": "36c8436e-828a-487f-8cd7-0806535bf2ac", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686918635, "uuid": "2dea3b7d-2701-4a68-b13d-34e5fa8b5530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918635, "uuid": "4773742b-a382-47d2-b405-eef8b7d020de", "value": "JKL-PO_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a51b7a-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686922735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922735, "uuid": "76032a77-1ad4-465a-84a0-a4402338b08c", "comment": "Malware payload (AgentTesla)", "value": "048579f691e6fe268d136660e522f9b1", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922735, "uuid": "a4a6ffcd-7335-482a-ac88-2dc3e543a56e", "comment": "Malware payload (AgentTesla)", "value": "6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922735, "uuid": "836e6608-339b-4e43-957a-14ee2627c855", "comment": "Malware payload (AgentTesla)", "value": "ad2c1ff3e7738baa7d2eee662e797fd84d0c50e7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922735, "uuid": "3b3c95bb-88c2-4b52-9c50-68664722dc3f", "comment": "Malware payload (AgentTesla)", "value": "df554f3e3a56f5fa527a9ea500ae3d85cbf7e784de4453e491f13f59d4e632bce4daf5c4e604b02df1c53646b8cad3f7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922735, "uuid": "5d2db75a-6a18-47d6-ae97-8c7e97b40897", "value": "T170C423AA6C1E37728B20375896F24757AB3433D7E3E665F2281CB8644AE05CF35C21D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922735, "uuid": "24a6898f-ccaa-429a-a01d-3d05d5279af7", "value": "12288:r/0U4w+8zDG2/FmDGblwV/4Mt0Ps0GuTHWl6Q4DK3PLp8lF4nLnW:nX+tcmDGbOV/RtCYU2loDK3PLbLnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922735, "uuid": "69c946e1-6d88-4244-acaa-165d753174a8", "value": 573396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922735, "uuid": "dabc95bb-0b6e-4c0f-aa35-367eb14e1e55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922735, "uuid": "6d7eb2ef-2b7c-420a-a0e0-754a3da0a3b7", "value": "PAYMENT COPY.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cfa87a-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686914315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914315, "uuid": "cb4384ad-d586-43c0-bca3-48abb3187378", "comment": "Malware payload", "value": "5500ffc950d2a3b95a54774742afb596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914315, "uuid": "cb97fbdf-1962-4503-a7f2-68440573b7be", "comment": "Malware payload", "value": "6dbfb739f26b9050c2def9f0ac143a4e9fca161a634174b533be6d480cf70764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914315, "uuid": "50a6fb71-4f67-4db0-b34f-bb11f6317b94", "comment": "Malware payload", "value": "2dadeaba77dd88d4f2e4b5c69e5e7e1cc89a2f75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914315, "uuid": "eb85d67d-8f11-4d62-86f6-2914bb0b3b86", "comment": "Malware payload", "value": "b4a6855862bfe3481971f23958d6cd1ab0c84c04065be3a84ca9a4825c8d0d9652019bd737b4e61b03f2f9df32298c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914315, "uuid": "e106cf40-5be5-48ec-bcd8-45e8d4e50ad6", "value": "T14974F781E5801190DD699771EA32CE3592337CBD5A34A39E2AED3E373FBB2C34529152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914315, "uuid": "d01207fd-8171-4bc7-949c-83da3bd7f353", "value": "13c32f913271e5cf427548b785e74521", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914315, "uuid": "7a79e647-7e0a-4f0d-b66f-e28cf9531408", "value": "6144:X9VkhhrdYK94IgqHniOSyaZoc7QNPnP9TBOShUAkzL7r9r/EDppppppppppppppy:X7OZ5NnP9TAWgP7r9r/+pppppppppppU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914315, "uuid": "cb7c505a-a724-4db6-8918-8009bd75c488", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914315, "uuid": "9f6784d2-0109-4d7e-a500-25e5609468ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914315, "uuid": "7e0d7972-3cf5-4de1-9fcc-0ca5dc42727a", "value": "hsbcnet.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be74dde3-0c6b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686936739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936739, "uuid": "93f620d2-6c0c-4b85-a0b3-5e9ef7130819", "comment": "Malware payload (Formbook)", "value": "7fc485ae5f90386da1898e81765fdab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936739, "uuid": "031eafeb-c4c1-4601-a8b6-f79a9fd6756c", "comment": "Malware payload (Formbook)", "value": "6f85a62c319fb571c830e780979477a07f026ec86ba3278dc59ffacee958a53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936739, "uuid": "415172f9-6f66-467d-bc7d-70f419fb4820", "comment": "Malware payload (Formbook)", "value": "2fe03f3a03e79c41d2ab83ae1d88b1fa8807dc74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936739, "uuid": "8f49cc03-3714-46d4-adc4-de8fb40518c5", "comment": "Malware payload (Formbook)", "value": "89ef91d71b07c74bd57ed812f6399f93ef88570f8dbc669b1373f9337d93ae7389be244a9e735e7d3c7fe8d4e7f3a77c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936739, "uuid": "948cc93d-ea54-4b90-a97e-26bd2515b5f0", "value": "T1671512423614891BD57A77F84F6161B437FF9B9B3C16E3CF1D9BB1C8A8D6B060A10A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936739, "uuid": "88cd33a2-350d-40d1-8aac-1e1bda930fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936739, "uuid": "c5d8aaf2-3637-4ec0-9e76-f0f0f9f209aa", "value": "12288:HdcvG73htU7/2eQ1x9mDfTqDpnuqUNb4Um6m5bbbRG7XPIy:HdgG1tCueiQD4puqO4m0Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686936739, "uuid": "8e1b44d4-bbfd-4cdb-aa49-a4123a34eba3", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686936739, "uuid": "545f87b2-4456-4756-ab5c-709b84f6cb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936739, "uuid": "e686968b-da4c-4935-9348-72066254eba3", "value": "QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f8386e-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686914176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914176, "uuid": "2311a03d-d933-47de-8903-b2c31673dd9c", "comment": "Malware payload (RedLineStealer)", "value": "cb49e994b3e8969a32f5be3187d15e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914176, "uuid": "6e72e2ec-2de9-4d72-b610-4707d8bf1692", "comment": "Malware payload (RedLineStealer)", "value": "705dae41f74ff7fa9f5d4474d3474422d69e20bdebb9c36c020978de8ce48368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914176, "uuid": "72440b25-0789-442a-853f-a066bb43c56e", "comment": "Malware payload (RedLineStealer)", "value": "b17170db03d1ec38d3d8b1acc183162c9d0f75ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914176, "uuid": "265a6d3c-1608-416e-960f-d1fb54b8d860", "comment": "Malware payload (RedLineStealer)", "value": "746f441a94c61041f6409d6c7eb17c3b887179cc15db909049ef7f6c7bd153ec7b9ffd1233f892a9f4e999f06c078bea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914176, "uuid": "338d7fd3-ab63-4d29-a522-17915c75a81e", "value": "T19144280235E0BE24D441087F7879428BA6BE6DDFF7DCC4F6116421976A5B2992F3833A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914176, "uuid": "01eceaeb-572c-4d98-a983-0d9f8cd804e7", "value": "72acaf8dcee1b47852a7b85487e3884f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914176, "uuid": "b05db236-5e12-4d51-a48f-040b5f4d2ad2", "value": "3072:O/fEiXOn5dBBApSkP4yjbO2otK0yCZRpym2bwXmcB5Cl0p+Wh9EFYTaVhLNphuA8:g/O0pSqotK0yCd0WTTaRphO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914176, "uuid": "7941671e-e5c9-4f32-a255-0a08dd081c53", "value": 270456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914176, "uuid": "9397583e-cfb8-4d5f-86ea-3276f2cc19d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914176, "uuid": "eddd3bfc-7f54-4c06-a782-8866adc5c4e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974e27f2-0c4a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686922500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922500, "uuid": "c80ec6c2-3a1e-422f-94df-e2e4d7073e0f", "comment": "Malware payload (Mirai)", "value": "4c4487a780a3fd56b9f5638792ab99ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922500, "uuid": "f755e31d-cc42-45d5-93fe-e300579fd204", "comment": "Malware payload (Mirai)", "value": "707cc46a7a55a494ad3cf0e4aed849452b1ab26cafd40559df92d0198465255b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922500, "uuid": "71efd22a-b13a-4708-957c-8a257432a7e1", "comment": "Malware payload (Mirai)", "value": "694e44ef55bd6811f1ee384efe53a481c866a7a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922500, "uuid": "19333cfa-01d0-4460-b721-25b3b4c65f2a", "comment": "Malware payload (Mirai)", "value": "62b3dca3242bdfc6e16ba3504f6e8d51682657a94cbad69e8f3512b6385fdca9f984f477a220c5cd3157da2be28b04e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922500, "uuid": "54d47e0a-a297-4187-8a98-257aa52692df", "value": "T117F2E01B4577DE34D83AB973A9D1A798B8A528374004076F8CD2767F86FB9803B741B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922500, "uuid": "5d9c8f84-f13b-47c8-8a3c-3f3d5f4e6aa2", "value": "768:PdXCmnNFjPF27E0+gy+0PYA6vbAi3tD8MhytDQSv9sPC7:VS2LPD7J+h9vbAqtdhy5FuC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922500, "uuid": "c13f224b-0fa2-485b-a9f2-5af6a829d3ab", "value": 37372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922500, "uuid": "0cdfc25f-2eda-4f94-b8ca-0b128b12e78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922500, "uuid": "452cbf95-da34-4a19-bcf1-d27805a45a21", "value": "tsuki.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01275b2-0c3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686916179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916179, "uuid": "d7dac0c1-e79e-4790-a529-27c70de635ba", "comment": "Malware payload (AgentTesla)", "value": "8e64daacc62555378a029407e760c3e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916179, "uuid": "da9ca620-3ebf-4dac-ab7b-cf2afbd6875d", "comment": "Malware payload (AgentTesla)", "value": "71626f4c825903dc56b7df19096cf84ae800ce19aa6e02f23d72fe847eb3cec1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916179, "uuid": "76701a92-6c08-4d8a-a819-c679982409cf", "comment": "Malware payload (AgentTesla)", "value": "ea5a849b373d02bf7d5c642feb5a84fc91cf7c03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916179, "uuid": "6a765942-34f4-458c-a83c-b691c4dbe5e4", "comment": "Malware payload (AgentTesla)", "value": "dd96434b71cc2fae1185b825c0de5ee2589742f2a441f5a98d96b5a95e4bdc57621146325afaf05dd456683cf642bf99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916179, "uuid": "a9888384-7b8b-4cb9-b267-41e108d61bd3", "value": "T1E005021026E8CB2AC07F0BF548141631877A231AF577E7060DD2B5FD1DA2BD3965BA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916179, "uuid": "ffdf65e1-4bf0-405e-901d-b5a4296f4d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916179, "uuid": "d3e57502-8617-424b-836f-fce9bc5faddd", "value": "12288:zNx4/a2iNx5LbzIu9+r9V4qXBJpyPlCm8kCT+lRfTnLKJCO:rOa1j5LA9V4qXBJsPlh8TKfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916179, "uuid": "ea44853c-36cf-4c77-afb1-ba4afdc4dff2", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916179, "uuid": "cb55abd4-a1eb-4059-b5e6-4e47350924cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916179, "uuid": "acc9c4e0-487b-4677-8101-9d423cf18a74", "value": "z1RT435HT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3912890f-0c6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937374, "uuid": "3e149f86-63c2-4e61-8300-6ab8d24a6dd2", "comment": "Malware payload (Mirai)", "value": "61475c9a2221beed762a87e62e4ee6cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937374, "uuid": "fcccbc01-30ce-4eb0-b08a-222151ee677d", "comment": "Malware payload (Mirai)", "value": "71bc414ed5e55b4ffd3ff1faa78b6bbfd123efa0a9baf54a9df61d810df34d27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937374, "uuid": "c91ccc43-855f-4d4a-bdb3-71d2f5461895", "comment": "Malware payload (Mirai)", "value": "756678ebde6f6f7c4e18df2d779938ed9933bedb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937374, "uuid": "38944d33-9e3c-4c28-afea-5ae1946763ff", "comment": "Malware payload (Mirai)", "value": "3ff89f77c13c7efd7d40b5026963117729217a74a3e801397f9f8d806d594ae6fc4f2b667a8e145bd485e19c252d32c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937374, "uuid": "5964d495-35d6-4ac9-a65c-56e1af8aa16a", "value": "T1F9C2D070A2ED2CF1C3600532E6BC5BC9BE530F7DE9EE2890214167BA3D81D4529DA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937374, "uuid": "75f121ae-e9d7-44f6-8dab-af9758595ee0", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEJRWeJTruhymdGUopt:A7soTAZ3alkXLvFh8nNEfhJTrus3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937374, "uuid": "ecae2512-ffec-437e-91e1-7d36dca6f528", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937374, "uuid": "d9d468f3-e8ce-4b49-bda6-53f7086a8b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937374, "uuid": "d548cba2-950d-478b-a244-66dceade7d82", "value": "61475c9a2221beed762a87e62e4ee6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30afc5e3-0be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686879807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879807, "uuid": "eb86e8f5-1543-47ed-a539-a648d291d170", "comment": "Malware payload", "value": "2ce8813c4ff22e1d22d5d51e5cf06442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879807, "uuid": "d05d955a-5471-4238-a7a5-c2269844d5fd", "comment": "Malware payload", "value": "727a8386a6ea27da6ea713cc7a665fe55ac6ffa0186aaf743bc441483906f936", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879807, "uuid": "f5014ba3-f1b6-480e-ab9d-c860296c6b01", "comment": "Malware payload", "value": "a81ba26621594257ce7d895d012d4d2f8676b27d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686879807, "uuid": "0d888c4a-8dda-42e6-ae9b-4957a8996324", "comment": "Malware payload", "value": "38f830524934d24050f500f8ecd9ef5957b2b820480e87de64ba18e9e0131fcc440371506a2d9c9cb2dd1646016fd82e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879807, "uuid": "4619b49e-614b-462c-9bb6-831deae9947c", "value": "T16046239A34E98DF5DAC60C308D1F6AD763F152618B818C6EEEC05E86E531EF6603A543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879807, "uuid": "89aa6d3a-c007-4a4f-a96d-48c53ad7904c", "value": "e168b9d4131706bae4420b007e9cc65c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879807, "uuid": "fd350bb2-f9f6-4a80-8d33-090f18426d8e", "value": "98304:qYppZibcmB+KAovXPyRcwwt2XSIosBlDSPFJc0Gyy3ZgmuvuoOE:XZIBn54SsDwfc0mbAuvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686879807, "uuid": "21f91ec9-9c83-451e-9495-ef9b7adda5ee", "value": 5464576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686879807, "uuid": "5b9aff28-8da7-4cfb-80cc-12d4ae2913f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686879807, "uuid": "2241f9eb-7a98-4fc1-b4c1-791e6afb69d2", "value": "2ce8813c4ff22e1d22d5d51e5cf06442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f4a296-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686914302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914302, "uuid": "188e132b-ed58-4bf0-878b-4b4b3f11902e", "comment": "Malware payload (GuLoader)", "value": "c720da2df2b14990798df3c4512805cd", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914302, "uuid": "dc2b32a9-615b-45fc-ac39-dd0f7c6424db", "comment": "Malware payload (GuLoader)", "value": "72e65e6a505b198e6d6111c460f1e2859cc8ffea374129d05287da8d85e675fe", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914302, "uuid": "85c62c35-0e93-429e-9f3c-6b0e74017b79", "comment": "Malware payload (GuLoader)", "value": "fc62f7545012d2d2e0420d56bfe5debba795a532", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914302, "uuid": "7e78d7fe-ba94-4e0b-9a2b-274c523f6cfe", "comment": "Malware payload (GuLoader)", "value": "3cff11c3dbedc9ac839e8ecdbe293fabe05ff8d6dc693a946769e9e023d88b20a22214e06d50f6cee4451e2d4ab3bb6f", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914302, "uuid": "949b1195-02ef-4bad-a23b-5b282ec24e91", "value": "T172A4CFC1F51080C6D5FC0A737D9A722535F47E6CD9B0263B52A6329AB7F32D0291EE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914302, "uuid": "696d0cc5-9269-475b-938a-15a5f1d58fbb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914302, "uuid": "68dede4e-2588-44d3-a21d-7a0043a2fece", "value": "6144:iVGdx6xeUgDBLCPG52keH83kifSZmNeNzi1+932TDKAD+yrGgs+/kmIce36osm:WML+GZeH83kifKGWzYCyNs+Mg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914302, "uuid": "d869c695-06af-4062-ac71-a1f877310fb0", "value": 489480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914302, "uuid": "836bea7e-3b83-4f30-a73b-f96e18eec227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914302, "uuid": "df4a84e8-24fa-446c-89f6-620dd112957b", "value": "payment advice.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe82b96-0c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1686906649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906649, "uuid": "ddda1133-f491-4a94-a1f4-a3a8d3a0f1b0", "comment": "Malware payload (PrivateLoader)", "value": "c598f8f5e7da50689d84a1aae6685959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906649, "uuid": "1eb28f71-035e-4695-a32d-c256069126c8", "comment": "Malware payload (PrivateLoader)", "value": "732181b387ad5f56ac25d371ee4c98ddd6b2d7a2ffab384bf81b6820a80c4a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906649, "uuid": "5871a707-c658-4d46-8300-b5dea54fe9c2", "comment": "Malware payload (PrivateLoader)", "value": "2a2365c4b8205a2825487e51d4bf171f071fc4fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906649, "uuid": "95610e96-0b50-4acd-9467-47af414d54ab", "comment": "Malware payload (PrivateLoader)", "value": "11d816d275018566e067f32070e8690f419d91b53a51b6b76e443ce2267af48e8f81139cecc7a0d44d6d9573a54ca85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906649, "uuid": "e9b7da8f-4a4e-4037-bd9b-2ea09f9be744", "value": "T194169D12FA818036F59601F292FE0B7A5ABCBE30131054D3D3C8699C6F655E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906649, "uuid": "94a62abe-a753-4089-a92f-3ea81c9534b1", "value": "292aade11672b3abdd24722742cf6115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906649, "uuid": "c753cf7d-d207-4e23-b51a-d9ecf73105c2", "value": "98304:0mAjs9ptTJm/IGtg+l2ZlDsq9z/fb0CzMnQyNciVuB7P7CbXIKc5zD6sILTjblM4:9z/NzMxN6iLIKcosI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906649, "uuid": "257503bb-48c5-45c6-ac9a-b55cb4df94e7", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906649, "uuid": "ff80da05-8da7-4bd9-8d8f-0dd59b38a086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906649, "uuid": "b9455da5-38fd-436e-84c7-5a59842950fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bc75b8-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1686922708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922708, "uuid": "93fc2f70-70d8-410d-a14d-411eb673f949", "comment": "Malware payload (LummaStealer)", "value": "12fe4e39d87bee0ecbb37c25ec9b23e5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922708, "uuid": "6f57c399-97e8-4647-bdf6-9de1652b759e", "comment": "Malware payload (LummaStealer)", "value": "73cf02a9ac3b500eee74f9624f03db036565f0841c6a70ca583f2f17bc0efb08", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922708, "uuid": "da28518f-362a-44b9-a4a7-62226d77666e", "comment": "Malware payload (LummaStealer)", "value": "4065cceab417e7a8a698e64cb1e6c0afd158e159", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686922708, "uuid": "1883ed28-2ddd-4b12-8579-ccee60b90f0f", "comment": "Malware payload (LummaStealer)", "value": "caea7a3d07fd79fb099b6076877ebbeed8dc1d5ec060c217601a2044f4765fcb1a6317bb462c64a1dea8652f62c09840", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922708, "uuid": "db2b89f0-712e-4950-b80d-09725cb90346", "value": "T1FC516B4DE0652209C8E32FB0FBDC0350D332D5D1E6B8027F26EF6158CF9326A1A0AA47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922708, "uuid": "d9bb1c33-75a0-4c07-85c7-3a6360e6df3e", "value": "48:94BXAnY7TZWp+QHEOIt23PRxEXYvsFjZEU5bJGqxEy6NbKtVOLJ7/M6qE2n:snJXZTt2YovsFy8J5EyVtVO1o6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686922708, "uuid": "c99c7fb2-1af5-4586-b167-23ad8e1c998a", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686922708, "uuid": "088e4cb8-e99f-4be0-bf0f-69e8045b0c56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686922708, "uuid": "8cbfd155-ec85-4173-968b-63f784507d06", "value": "invoice_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07bf919-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908905, "uuid": "53c873be-bc0a-4a06-9461-9ed81d2d8ed7", "comment": "Malware payload (Gafgyt)", "value": "45336bd940ac9c35730046c102aa4580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908905, "uuid": "145795a1-0631-4d7f-8d24-4e067ef0bd56", "comment": "Malware payload (Gafgyt)", "value": "7526f38929ac4d8e0cbfd626c0ea1f31425296cacf60b6b76e5cebbb7b7845e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908905, "uuid": "27eb7d3a-d97a-4306-956e-b55f777dcf25", "comment": "Malware payload (Gafgyt)", "value": "03634b2fb80827f26dd69ed9fc7948ed03c5afba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908905, "uuid": "ca6e6f26-1d82-4035-a6fc-38e95937370f", "comment": "Malware payload (Gafgyt)", "value": "652d39a58f997f2ed36d6d2f11beb4d1e3b783de65a84a77909802ce13a272055bb8a2a080028a607f4108119cd36ed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908905, "uuid": "a7a1f0d6-c0c5-408b-a8e4-73fcab703792", "value": "T17EB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908905, "uuid": "53130c4d-64d0-4f2b-84d2-f78ca357d452", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjC/B5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mjo0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908905, "uuid": "6498d24b-6c3b-4c90-afd9-836cd0c97fa4", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908905, "uuid": "05716781-82a4-48eb-bdc5-d7546a17d642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908905, "uuid": "30152781-f4fd-4a49-8c1c-eec78d6edf6a", "value": "45336bd940ac9c35730046c102aa4580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2856b143-0be9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686880652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880652, "uuid": "6290b79e-76af-406d-b5df-b92ff9e3bb4a", "comment": "Malware payload (Amadey)", "value": "90939b97fbab41ca26cb22e8f7e6eb90", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880652, "uuid": "0c7346f1-9f0e-47f3-b6d5-845419ceef03", "comment": "Malware payload (Amadey)", "value": "75d7a866c943b4f3a7f1b5a5dee289d055f3315877a22cae06d1e2985b724bb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880652, "uuid": "1ddec0ba-db3e-47e6-b2ea-64d0281475a9", "comment": "Malware payload (Amadey)", "value": "901fb4708bfe0b9386dae59b3dfb9b20618632ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686880652, "uuid": "0d9ec670-5ec4-4b26-a095-ea45c9a85be8", "comment": "Malware payload (Amadey)", "value": "a4aba25bf6ffcfafa30ea9276b7657551483fcb8e4e1c8c022dbf8f7f4aa7e0a0c835f04a25596de1699bd4ffe54fe1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880652, "uuid": "1508e7e9-c2da-4a11-b46a-1d1c598f8c18", "value": "T129052353ABD4A437EDB817B15CF613830A39FCA56D39426F2B42589E5C72280E47273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880652, "uuid": "bb1c9abe-b24b-4316-9171-46ba85c97a6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880652, "uuid": "c2240d5f-4c76-4227-9afe-73e829e8b299", "value": "24576:gydFQKgN0dLc06qzXOhk6b9xA/PdjbpmR+Gni:ndyZN8UhkqroVwR+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686880652, "uuid": "6a5fe651-de9e-4e52-a662-c5d24491dee0", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686880652, "uuid": "9252f8c2-1883-40f3-9e5d-93023277df70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686880652, "uuid": "2fa84bec-959d-4d6f-89c2-5fc6c774d688", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b335e6-0c33-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686912476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912476, "uuid": "76238b00-9150-42c5-972e-e41f270c5f58", "comment": "Malware payload (Amadey)", "value": "e62e00704af39f4dadf0dd3e9eec06b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912476, "uuid": "aecc26b4-3a22-4d8d-a39c-ac957968dc48", "comment": "Malware payload (Amadey)", "value": "7602664351a1e06c5aa6d49197ece588c8e526f43103cd236372f0848ef68731", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912476, "uuid": "d87d7f97-ff4b-4553-9fd3-e9a133464d53", "comment": "Malware payload (Amadey)", "value": "9c17ba183cff978da57f6f1897556bd172257029", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912476, "uuid": "2a3cfeba-7dd1-424c-9b53-4d85c1ac4839", "comment": "Malware payload (Amadey)", "value": "3d27da40084ab3a28ecfb5ed3378e1bc3f99a701ca127fba2bcbaf3d7a10eaebe48d4c997ea3b89e60d781c1367fd3e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912476, "uuid": "1c8de53d-7b33-4714-a7a1-92be9ec8a5fa", "value": "T1120522539BC86071D8F827B058F207C30A32BEA25EB48257174B955F1DB36C0A97A77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912476, "uuid": "017ed36e-56d9-497a-9f90-9947504d386d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912476, "uuid": "84bce04f-850b-4a72-9ee6-3581a55a9776", "value": "12288:2Mr6y90qB/cxwUiRp8jg8WQdARn5Sgj/bjdoHks4AqLQnVbvoTIFR8LcMsuk:4y7eeUibQdGrjndoEzyBvkascM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686912476, "uuid": "f3a5762d-2982-47fc-96e7-3410b1df3d24", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686912476, "uuid": "3105e907-fd6f-487d-a373-58d3d485eeae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912476, "uuid": "26537055-bdf5-4146-bf73-b7653085bb7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95831227-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686925503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925503, "uuid": "28635e7d-f89f-4b89-98b3-c01dbe35b326", "comment": "Malware payload", "value": "cc65b56fbca9a72ac09daf8952f25337", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925503, "uuid": "9c8be33a-a9b0-4554-8a34-a8ae6ef8f01c", "comment": "Malware payload", "value": "765caa4bc979829206db6ef045bcf79a091424a541e0ba62c27301e0c6ab231b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925503, "uuid": "110e5f1b-2735-459a-9315-f3483969df09", "comment": "Malware payload", "value": "50587d65c670aca82d20f24f75fb8b05aad3c13b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925503, "uuid": "04674dce-9f83-4517-b9f5-9c64aa955a1f", "comment": "Malware payload", "value": "f2534f6c7d99ae0855552869099e1c614b58a24af38322f38e83df32edf24f8cd52d1e5dc5d2a7ee42b7eb2853e0e402", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925503, "uuid": "d1b1f8b5-acc5-4164-861a-493bbc927d76", "value": "T1383523E420212EA64CF4A23A646EBE1C1B6FCBD14315F4EE51E2E4C3D25DB87C9865F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925503, "uuid": "98160e20-6365-43dd-a5bf-584a2abadf2d", "value": "24576:zJB7pG3GRXVNS9tM0tUgMRvOiU8kTYC9J:UK9/RvaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925503, "uuid": "fafdbb4f-3c2c-4bfb-a8bb-3b0184692d84", "value": 1150815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925503, "uuid": "cee79da0-03e6-4e2b-8d1f-845b3599f81b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925503, "uuid": "1ab65a02-5684-4b17-acc5-6eb9d5ac0930", "value": "Credit Card Auth-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9b62f8-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686876502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876502, "uuid": "c37ba456-242f-49b8-9f4f-c2bceff7fc85", "comment": "Malware payload (Amadey)", "value": "052e5edfe0cb0c180a2c62859d24590a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876502, "uuid": "9b1c1910-f3cc-4ce4-8460-e26efac39ccb", "comment": "Malware payload (Amadey)", "value": "778c94dcddd3ab8ec8ea417f79fca412da2a555c96ac140be4a7bce9a0b406ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876502, "uuid": "48bacc22-6ea5-4ef3-ae70-91890444cdc1", "comment": "Malware payload (Amadey)", "value": "67e6c1dad03ee038f52aeee3141bb4389185c75b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876502, "uuid": "693ba546-f997-453d-9600-43285a17e48b", "comment": "Malware payload (Amadey)", "value": "f8595241bb2ff6088e1e6013df4b08a954cb02c55aeb94ebc2d8ae35e8bd0f44e672a37a8bfd0008530130a2df800897", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876502, "uuid": "19039ea5-afdb-4134-a0d7-b670036cd0b7", "value": "T14A455A6335BCE4ADB579CF6645FCA69A4C3DE2036F21379D4A20035268289C9EC7127F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876502, "uuid": "e42d5b31-548c-4152-916c-e6842c218241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876502, "uuid": "90b91d7b-dd1a-4b72-b15c-c5985cb93c82", "value": "24576:kHTHGDFS3Ud358XGF96Gjp3RcUPi+65N:kzWgu58WFNpBfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876502, "uuid": "1ae25766-49db-4d8b-9961-3da796588c36", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876502, "uuid": "07844768-f80c-456f-ba1f-e438053fd713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876502, "uuid": "0b61a5b3-26b6-4154-8da7-5b5f52e8378b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bb3b63-0c41-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686918444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918444, "uuid": "ca279b01-fd28-40e7-ad42-69a66db906bb", "comment": "Malware payload", "value": "fbb17233217f4c478c9ce3907e8dfef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918444, "uuid": "acdb05ea-6984-4322-98e8-ee94f9e3a555", "comment": "Malware payload", "value": "79f68c9a2d1fdd27465c2cc6e2e90da2e2a6d90a5346ab5b109b64fb7457b6ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918444, "uuid": "3ee5cc99-a5e2-4f94-a092-35abb83f64c0", "comment": "Malware payload", "value": "365df15b6950f5f1749cec380ed5bba8c6c227db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918444, "uuid": "d9626f5f-b936-4768-8016-e559475e284a", "comment": "Malware payload", "value": "f15c8e216701a4bc330d7c404ae19fea6f3624f08cb9b63a1a4996803f866b0384c26fc66a7a237d83f77eb8f402b1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918444, "uuid": "2a9bbe69-ed39-440d-a0e6-c32e3bb161e4", "value": "T1A6A55CBB7261D629D10DE13AC892AB02A837BCB14733C5D751E57A74CEBA4C24F3E254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918444, "uuid": "7606fb2c-d8dc-4f53-95d2-2dab736f9c48", "value": "336ea03f063d70d7828b1ca79d23bc32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918444, "uuid": "61901337-e4f9-476c-8c9a-6a7263650701", "value": "24576:B/qEChjzz3F8mvKhx68xjf73b3KteFUp9HHJOApt5Xkoe/T31XQn:IECBzzGmMb6IS9JRHXkoeLlgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686918444, "uuid": "f2dd6c01-04c3-4716-867c-41439b14c7de", "value": 2191872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686918444, "uuid": "0c20d6db-e328-44a9-8f1c-af053f2694cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918444, "uuid": "c641ce7d-02c4-4c60-8b4c-fd6da958b1e4", "value": "\u5ba2\u6237\u8d44\u6599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db384eb5-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900709, "uuid": "a1314040-88ae-41bf-a240-3e2f5ca757d3", "comment": "Malware payload (Mirai)", "value": "1c70fca2292b9987c2645339c4a980c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900709, "uuid": "3ae5ec8a-db01-4661-b650-c459abca3872", "comment": "Malware payload (Mirai)", "value": "7d48a0e5990de34f9fb7ef4c51a0ed601bc2718e743ca46502735918a7d621b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900709, "uuid": "423c15fe-1f40-4fb7-b9f5-998fd6d39219", "comment": "Malware payload (Mirai)", "value": "bd7161bde481b3dfa70d7a05f7b0c7aff6c7252b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900709, "uuid": "bf9bb50c-2009-42e1-a08c-9611f90e3dc6", "comment": "Malware payload (Mirai)", "value": "737d47526dde8a5843d5dd86cd5a9e9aed060d58d53b7ee81c12cf1cc44cb87ae9fa98c77c7ede695f8f642373341120", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900709, "uuid": "83425c1e-8c17-48d9-ae98-db1cc9805692", "value": "T167634B01725C0E47E1A31EF5253F27E193FEE99020E5FA89650FDB864231E37468AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900709, "uuid": "7e89bff3-76c2-48c7-9cec-641e6d072b2a", "value": "768:sKcL8O4n1eRtPJf61jNfRhkGMkRayHnJ9v2O47DqSD3fB9m54PSnkC25HqG94hFG:O4Sj61Lwm49myKU5KGOZZGia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900709, "uuid": "d4ed47ab-1196-404f-b251-788f4c8e79e7", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900709, "uuid": "f85ab3cf-e759-4c3a-9be5-e8bfdc738ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900709, "uuid": "2dc182c3-1d5f-46e9-a764-ba10ea45f5ae", "value": "1c70fca2292b9987c2645339c4a980c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339315b6-0c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686892697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892697, "uuid": "4fc2be8d-71fb-439a-87a9-0763fa194a2a", "comment": "Malware payload (GCleaner)", "value": "232f6e013fb599f468fef265ce75e199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892697, "uuid": "1aaf1005-22e6-4abc-80e4-8956e92a27ec", "comment": "Malware payload (GCleaner)", "value": "7d9e1f4ae37a473faf44cf4afdea2a592c68e40ad65809f79517493a2bcd323f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892697, "uuid": "0a9ecc5e-3f55-47a3-8688-738ba43aa896", "comment": "Malware payload (GCleaner)", "value": "0d393085ccfede5752fa0143c3210cb8c80be44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892697, "uuid": "75c3bbdb-8b7c-4cc4-b7fd-903f2bbffa63", "comment": "Malware payload (GCleaner)", "value": "5f41d246effc4eec7b6a299dcd367709b2460c0832e8d9a6f18b7522a1ee6728ebcc8083bb93ac34411b8983860c6a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892697, "uuid": "aa1bb7e9-a65b-4a0f-a149-cd6d0a5ceab2", "value": "T19AC53343E31598B0FD14A670183B9E209F177EBA643E84B86ADE71921F735D11CB923B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892697, "uuid": "7e3c436b-a411-4d73-9b86-af0303ee6ae0", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892697, "uuid": "ad7239da-63f3-49e8-a879-9bb80b4ccd11", "value": "49152:86dFzcjaQu9lc965IGzx6OJ/TuQht2lHnE93p2nwDOZ:bdFziaQp965tzx6cqQvgk93DDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686892697, "uuid": "9b1618d7-8ab7-498d-932f-8ecc06460364", "value": 2604112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686892697, "uuid": "de8d0bbd-e890-4bbd-9d1a-fac27a2284ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892697, "uuid": "d19cd15b-e9dc-4656-ad3e-261f1a849c94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98b623b-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908920, "uuid": "c9f268d9-12ce-478f-8eb5-88b3895b7d75", "comment": "Malware payload (Gafgyt)", "value": "bdde1e904c5ed356bbeee259d3cd7a07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908920, "uuid": "619f9634-e7b6-4dc5-82bc-8c67e8806ba4", "comment": "Malware payload (Gafgyt)", "value": "7e26dc160a35fad49bdbdeb1b5c6277e17cc206e3fc0a9daccc1d2db377db71d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908920, "uuid": "af6178b8-5899-4c75-bcfc-001ebed12092", "comment": "Malware payload (Gafgyt)", "value": "dbfe8bfd24f34ca290f8e7e490a5d3531548ec74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908920, "uuid": "9ce794ee-380c-469d-8720-d4ea6cf8c2d5", "comment": "Malware payload (Gafgyt)", "value": "92432bbc612c667852a93c6d2f342176bcaa8064d1b894a521d030ef00e6883ac68b3707eab1c1c51e12592c937b6b04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908920, "uuid": "b5d71f37-13e8-4068-b49b-0aeda2c8200d", "value": "T1E6D31905F460875BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908920, "uuid": "b0657709-c323-4394-a5e6-5838c9b35fb1", "value": "3072:Sdf+fvEqa9FazYA7IboRh2e391CErktmCQA9FX9aH:ifWEqa9FaNh2e3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908920, "uuid": "0031b018-47b4-416d-b3fa-ea56246efa4d", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908920, "uuid": "41ec95a7-fa69-4e8b-a4de-580a4388df21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908920, "uuid": "9af6eaf2-d9c1-4be3-8a18-e67b228c1c90", "value": "bdde1e904c5ed356bbeee259d3cd7a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439e2242-0c68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686935244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935244, "uuid": "c219825c-16cd-429f-ad15-9ad1a3737937", "comment": "Malware payload (AsyncRAT)", "value": "2d84fdd1c64f0e6f0e279c4e7dec5d59", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935244, "uuid": "f9cd68e1-3a52-49a7-ab4b-1cc012b2d2e1", "comment": "Malware payload (AsyncRAT)", "value": "7e5bb0f599e8cc5dda819fde39fa424efd408f17110341ee4034e0c13b6c0226", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935244, "uuid": "cffca0bf-48b4-4577-800f-6636449d3e1c", "comment": "Malware payload (AsyncRAT)", "value": "a4b7e2396eb60a9a4c0521b3976f4bc53e393356", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686935244, "uuid": "c20ea67b-c5e1-4e3e-8314-e15c1647f0c1", "comment": "Malware payload (AsyncRAT)", "value": "3f5ddec8bf8a6d292a4c5608244efc1bb67050fdff55c7838af39cee00c7f0acf45a2fed09511efc61064ccd1e76bac1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935244, "uuid": "60e6dc58-289e-4a0d-b5cb-143bf2085e06", "value": "T1FE63F7053BE98026F3BE8F7469F6628446F9F4AF2D02D95D1C8511CE0632B829951FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935244, "uuid": "8111a2be-299b-4c3c-9e16-60154f86a67f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935244, "uuid": "6bd03078-7655-415d-ae5d-2ee09956d54b", "value": "1536:H2wukvF1ak9gcKu5UYFBRQbajJM1bWb64WaykrPlTGpx:H2dkvF1ak9Ku5UYFPjJM1bWborkdqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686935244, "uuid": "9d6b084c-5594-4897-ba90-f227086fdb37", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686935244, "uuid": "7e0ec3b0-b5af-4610-a584-493aa05a1d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686935244, "uuid": "636fabe7-9850-4488-bc20-6325e2c3ac24", "value": "bN7W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1959181b-0c7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686943763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943763, "uuid": "9ce6fad9-8522-47f6-bf7e-4da7d7160529", "comment": "Malware payload (RedLineStealer)", "value": "c37c8eb1de5f4f512df39cfb7d21b1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943763, "uuid": "90690962-1cf4-4f37-a30c-e4fc1238d7c9", "comment": "Malware payload (RedLineStealer)", "value": "8177f3f9855afb9aeaa8e5a9d3ef87617f511b29e35874e88c4ef49824afc287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943763, "uuid": "4768df43-1945-43e1-bed9-382186806b5d", "comment": "Malware payload (RedLineStealer)", "value": "c5cb14b85e71b804ac5fd0b0dcb1f8b1c16cfa70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943763, "uuid": "2982fbdb-b7af-4a63-afdf-f36ffc972fcb", "comment": "Malware payload (RedLineStealer)", "value": "30af3d2146e0bf4a43c27dc916ed3eb9080ec434b77c9921e7b61c180d19bb9588aea625eedfcbb3192321f4f0ef084d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943763, "uuid": "fd91a6f5-11d1-4033-a4ad-c5fc0c83c656", "value": "T1B7840703E2B23D46EA768F729E2FC2F8361FB6548E59776D51189B2F04B1172C263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943763, "uuid": "32997884-ee65-4818-a43e-130ea948ec4e", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943763, "uuid": "12fbb70f-2446-4ffa-8681-4423e2aca4f1", "value": "3072:K3VIHwKdD5JEmVwf/C2kFHD9aDHMjASQiiANKi6UXixv4UVVV32/8gQ5qhwh5Trg:NHFCNC2kFHDUDHeASrBNKDxgQV3McB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686943763, "uuid": "246efac6-25c7-49cf-84ae-0f53ffa06714", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686943763, "uuid": "304dbac2-0cab-4822-b486-e941cff79763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943763, "uuid": "940d25b5-9b8e-4807-aff0-950635ab3762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1281fe-0be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686877221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877221, "uuid": "363e91f2-aff0-4a31-85df-7ab05f88e4f5", "comment": "Malware payload (RedLineStealer)", "value": "f11ab2ec339e12969c408b0d34e81cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877221, "uuid": "1f63eef4-7aa9-4e5e-a2ae-0fdd743103e4", "comment": "Malware payload (RedLineStealer)", "value": "8181e54107c6bd696bfbb887745ca41dd65a27c9c2fed1ce7e25491d783445da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877221, "uuid": "6efa45e7-0e5a-4350-995a-a8fe5d287220", "comment": "Malware payload (RedLineStealer)", "value": "6f21807261589300fb8e454471305a8876c7ab9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877221, "uuid": "0b1d43ac-8f28-4c0d-9093-0a25e87ba8bf", "comment": "Malware payload (RedLineStealer)", "value": "179bc50fc4cf599cf081efac2da36538f89969ffff65a7406ada611a0027d658391acb678a27027b630bc8a79f295673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877221, "uuid": "a5d2c3bf-1934-4034-a210-5ada877c1b18", "value": "T1F4F42353ABDD4073E9F62BB059FB07E703357CA088B8875B3B56A82B44B3580643675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877221, "uuid": "904ff92a-4525-4334-bb0e-9e6144709b76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877221, "uuid": "b2349901-d872-432b-9e3d-401fd76fd842", "value": "12288:9Mrfy90VHnNH57bPr8nB3VvHBhwVNjsKP+cU8xdHSNM5:Sy+bPqvHzwVF2cbjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877221, "uuid": "1426d31e-e00a-42cd-8075-0242eaa71987", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877221, "uuid": "868bc7ac-767a-41f7-aeca-6b4d60966dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877221, "uuid": "2be0e948-9344-45db-bd6f-c84ba56740a4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e56b8bd-0c3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686915586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915586, "uuid": "e3768299-8184-4e1a-bf71-c0ab3aa7ba21", "comment": "Malware payload (Quakbot)", "value": "3106a030a6f3083be7e5809727687e4b", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915586, "uuid": "2db146c1-c0fa-4526-8cbe-b5a8370c2ba7", "comment": "Malware payload (Quakbot)", "value": "81e49a38bf964c207c561656295ec4d349c40239342fa59ed761cb4efad9490d", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915586, "uuid": "338b3a77-ff93-4950-a7bc-84e97240447a", "comment": "Malware payload (Quakbot)", "value": "dcf81a4b10c7d6122fc68253172fef4cf59aebbf", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915586, "uuid": "03a8337c-d031-4757-a86f-aafcf68caa88", "comment": "Malware payload (Quakbot)", "value": "2cc96ca1de54a69a9a7ece0c60158cf312fbbcdd7f2db685cf816e664e3d66915e7af7ee4bf181dec4d9d4d6b1b406b5", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915586, "uuid": "c666fe41-c1c3-4e01-a934-7d49f2ab5298", "value": "T162558D81A78354F0E496757473AEB63F4B393748831C81F3DBD42E81D9391E25ABB298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915586, "uuid": "234c03a8-71eb-41ba-828d-ffb9511bcf32", "value": "0c82c186a57f1cdec6d116d473f51dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915586, "uuid": "79765248-2e50-4081-9606-2ba55500efa4", "value": "24576:KGSbIuGSom9C0k1HH1cqj06uPi2bro8nuuDYmc1WpFgiYnGn6AW:Kf8r9W01Gn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686915586, "uuid": "8c37b8d9-58df-406c-a339-b380d0617058", "value": 1303676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686915586, "uuid": "9f7837b1-9000-4399-ba61-fc3944506f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915586, "uuid": "ab6a13db-d199-4cea-b78d-3ad9fbb11b4b", "value": "4000hz.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5bd8a5-0c34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686913217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913217, "uuid": "57c13d2c-7547-455e-b22b-b415b93314f7", "comment": "Malware payload (Formbook)", "value": "d9147e7cc518ca55cce6114c0ae5a45d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913217, "uuid": "183ebb6d-48bc-4198-95c8-f5652095592c", "comment": "Malware payload (Formbook)", "value": "82d16fbc771fc5c9c5ef32ecf33f802546a8d69770cd2eb75cc8f44e40b7960f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913217, "uuid": "68dde81b-d0fa-4611-89e3-ac4b782aec4f", "comment": "Malware payload (Formbook)", "value": "f44bdcb370b89d3c89dc090ceee0d9829b9b9633", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913217, "uuid": "e6351417-2733-4f13-87f6-360f2d461631", "comment": "Malware payload (Formbook)", "value": "317438ad515ec4f9b1b0c2fc0e087ab200976cabb44558b0bf5466d123742646d98bf5cbb31323271e820277bb869507", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913217, "uuid": "ca01ffac-b3ab-4812-991e-2659cf392ce2", "value": "T1F3D42333798B67B8C731AFFB8228F2E4FC58EB807E5A41150A17310A0B88E15D2571ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913217, "uuid": "11798998-c0a4-4790-b49d-aef0c90e7c68", "value": "12288:AxNRqWkSrm3TBjk+YPCQMKLUX93xvBks/yS8mFqRtA:AxTqvSruTBjk2KLUXPmW8jR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913217, "uuid": "a11ee361-048a-41b2-a6be-49c6b32a401a", "value": 608677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913217, "uuid": "029b761a-104a-44e2-8b4d-7dc78e13a8d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913217, "uuid": "87cf2d86-6088-45ea-90ce-3c45063a013c", "value": "Mirus Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e36a3-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925716, "uuid": "7e8d9a82-8d28-440f-8b73-881d733fcf90", "comment": "Malware payload (Mirai)", "value": "e0acda43c27eb84c1bb1fbf0e5b6510e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925716, "uuid": "91d4d486-b85a-4585-a18d-1dab6e781dce", "comment": "Malware payload (Mirai)", "value": "8409986880f185c0b002eb774d39275cdf3998bdc4ca56a665523433043582a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925716, "uuid": "8260614a-2c87-4d65-ad69-57bfc8b6124d", "comment": "Malware payload (Mirai)", "value": "b75a70558c8e7b295edbcbe50ef59bef3c34e5a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925716, "uuid": "0ccde4fe-11ed-4043-8b97-34751af9b4eb", "comment": "Malware payload (Mirai)", "value": "90caf51ce8a7d52a67c5d84775bf74188848c699ce95ba92462e29d88f285889fb82ee036941ba7b6668f49c70e10bf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925716, "uuid": "318a765b-e593-44b9-a9ab-e5b14b3c027d", "value": "T1E003E1BD9805BADEC02C2D39555403F4F90C6C83F2EFEB589B808A89D63454F646A4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925716, "uuid": "edc93e7d-ec1d-4521-aade-25ffc7635a7c", "value": "768:tMJknkNK+zxmRQWMjJ3VDcI39/bzFseqw+JUtCOANzkpd5RyZVIhBzbIWMz:tMgjUxmul3NbzFseqw+JUtCR5od5Rng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925716, "uuid": "dd1a7767-717a-42e0-b625-fac8db76767a", "value": 38504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925716, "uuid": "e403654d-5445-42b6-b1b4-eef7aff2d983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925716, "uuid": "227a8d19-8911-4828-9cb9-f1c1a4c703eb", "value": "e0acda43c27eb84c1bb1fbf0e5b6510e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be93115-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897596, "uuid": "ce25601f-de11-4ca8-9d76-74dbdf552e3d", "comment": "Malware payload (Mirai)", "value": "a652bb6276b3ad949f8383553a356290", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897596, "uuid": "404d124d-dde6-44e4-9361-4e6beb455210", "comment": "Malware payload (Mirai)", "value": "842357666dc734956498f28ce6d28ee4f3f1d46636d8e112ace483bd85c337c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897596, "uuid": "211d67b8-d812-43b0-8ef0-a001a5169e6c", "comment": "Malware payload (Mirai)", "value": "2ade1802a81dc906a3908f833983f15f93cbb490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897596, "uuid": "85b9bc0d-9c5e-483a-bd93-6707849740b2", "comment": "Malware payload (Mirai)", "value": "b2daf1d8344a7f682c4ff2cb58cd7d1b56622ed600b664ada8368ddaae71618a7166c39f70261d88223f187a13035846", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897596, "uuid": "912eda80-b34b-44f3-8cb9-7a9610aa0383", "value": "T1F2735D24A9792E26C0D4A17B62FB8361F2F6230E2570965D7C760F8FFF2464468172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897596, "uuid": "709bb951-fe62-409d-9fe4-5c29114d5924", "value": "1536:5ms+geQfvznpCR8ee84cNNAUiAvFI7IlNnws8M:YwfdNu4c7ZvFqI3w7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897596, "uuid": "b16c519e-ecb1-421b-8eb6-1b185f45a395", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897596, "uuid": "66c73c25-da06-4144-a31a-02b4d318f312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897596, "uuid": "d77b6062-f5de-450c-b308-fb8d604b0971", "value": "a652bb6276b3ad949f8383553a356290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdbc28b-0c7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686944412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944412, "uuid": "69fbc81c-5f23-4648-b8c1-032e9891c1cf", "comment": "Malware payload (RedLineStealer)", "value": "60b729605a4056710617f8ada31a3481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944412, "uuid": "57319bf0-9103-4c93-ab01-d1a870473b3b", "comment": "Malware payload (RedLineStealer)", "value": "844ec6982cd490e5fd08a9ecc4be54a3c8f5b43b76e0475b733573cb31dd9dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944412, "uuid": "a8e11def-9a9b-4453-9910-e639366df6ed", "comment": "Malware payload (RedLineStealer)", "value": "1b8000322aee0c7b70f5a4fd3a12ecb3d68b4ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944412, "uuid": "e186d83c-af9c-4556-a3ed-91bdc19c7607", "comment": "Malware payload (RedLineStealer)", "value": "c121657673b35f13bacb3aebf72c4dff076a1ad05834662041127b5abf77d8f3911db74cec727483327e326f756a1eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944412, "uuid": "aeabb963-3bdd-46c2-ac2a-000f959398b8", "value": "T1E9052223EAD45133DCB527311AF307E31B39BCA548B4A76B6340A85D0C726D8A93676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944412, "uuid": "4a0ecdde-bcd6-4e86-b534-c420980ac4da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944412, "uuid": "8cda755f-4fec-4b98-bfb0-5e135d4a87f6", "value": "12288:lMrAy909rRQT8tdY/VXG3O2K5Id4F+7sRa3Ifw5yHcjFxfN9KaHImzCawVYtO:VyCSXGn+as1THcRHvHEawVYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686944412, "uuid": "bd34dfb7-aa4c-457d-a2a5-92e042412417", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686944412, "uuid": "08133a7e-f11a-406c-aa7e-b711a274721b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944412, "uuid": "66dc2051-7b65-48cf-b664-3e2894be2438", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1678fe7a-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686905963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905963, "uuid": "9b3f0200-b399-411a-8c02-21f65f357ed9", "comment": "Malware payload (Formbook)", "value": "191e6663f1c7dd7e357aa9f03ec286f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905963, "uuid": "680f2478-4ea8-4319-b31b-a91d7c93bbfe", "comment": "Malware payload (Formbook)", "value": "8566d2bf58fe371e646076c60874a8fbb50de2fbf9b950c457804d316a3de89f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905963, "uuid": "913273e1-ec45-4fae-99d7-787663fc8079", "comment": "Malware payload (Formbook)", "value": "861b78a549dc321bd48206d4b9f1d8f905851d42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905963, "uuid": "605a1b8f-d352-4aec-b7cc-6ac1ac6a1317", "comment": "Malware payload (Formbook)", "value": "fc92d3dd4c13a6ececadac1895197489fab9d8261a9e814942a6ad27e1a3a5c45055e35d3bdce3d57a82c6681441f357", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905963, "uuid": "7e17a6a0-22e4-4832-b825-1167fc4a6063", "value": "T18393F60BBAAB55F2C3445B35C59B531003A0D6D2F7E3C23AB54D23761A03BFB994A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905963, "uuid": "c830c520-ddcc-4b83-a26e-4638d8854d56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905963, "uuid": "1a7d9f50-0bb4-45fa-9bc6-74b1c8a0fd43", "value": "1536:uIq/bq1rH/qsdF/PbUzrLHjJ2tzoZnjiLllFrWKavF0vB3BDy:uVO1bSszXwzrOz42rWKA61Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905963, "uuid": "871f6b04-8f0e-401e-8c8f-9d4abdb33fde", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905963, "uuid": "b814a047-5b84-470d-86f4-1dbad995ec83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905963, "uuid": "e124b0dd-4a50-4ec5-8983-f23e8a70776f", "value": "191e6663f1c7dd7e357aa9f03ec286f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1c54e6-0c59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686928841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928841, "uuid": "c789003d-a503-4551-ada6-ed0784ce7976", "comment": "Malware payload (Fabookie)", "value": "a73bdef13febf57a5b6af7022c0fba3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928841, "uuid": "8fbf0068-3b1b-448e-a430-02073ac80658", "comment": "Malware payload (Fabookie)", "value": "85b2316619510cb5e482c62b27714f9e8f83bdd8d73ea530d29e48bfafb509f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928841, "uuid": "e3e0fb8b-6553-4a7e-b89a-6d6883f10083", "comment": "Malware payload (Fabookie)", "value": "c28c67b59062338c71fdc1b9eca4b4addbd2e0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928841, "uuid": "4e4153ee-9a9f-4ac9-8b03-28cbfc3ec1ec", "comment": "Malware payload (Fabookie)", "value": "50df38715ddcc61052f81e0a5f18fa0fc4ba06f0ee3abef49078153705458ab6435ce9f1497577b8e94d984e90a7195d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928841, "uuid": "2e61d0c2-a830-4905-8d64-809b3f5cf14a", "value": "T1BA15CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928841, "uuid": "46608a32-57c7-4564-b654-073d1d9368a5", "value": "4d04b88c21f8346f0a20751957b8a59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928841, "uuid": "0cee589b-6ec5-4b06-a142-cd8da5b05869", "value": "12288:jXGexS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:C2S/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686928841, "uuid": "696c56c4-66ca-4181-bf44-0dada22def33", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686928841, "uuid": "2070d2f0-dad7-478a-9eb5-fbbc01d838e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928841, "uuid": "87ec19aa-ac07-4d26-8afc-d9c7dcfcdc81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bffeee-0c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686896192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896192, "uuid": "25afdf95-80a3-4257-beec-ec0ba7932a20", "comment": "Malware payload (GCleaner)", "value": "95007e55f7a7c636ee527104345a1934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896192, "uuid": "4659f008-ba23-4781-9a42-0c8ff4167638", "comment": "Malware payload (GCleaner)", "value": "86837ebc8b03063a75e2413bcf26962b7f13f59642d110424aa63f7d00c74c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896192, "uuid": "a5d56dc2-4f75-4da7-98fd-3bd5b1e8d47c", "comment": "Malware payload (GCleaner)", "value": "98683daffdb5d737be7d175eaa866f0ec267b653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896192, "uuid": "9da3052c-c79c-4929-a492-cb5dc0f38ddc", "comment": "Malware payload (GCleaner)", "value": "1d3a3e9e0fb3d8d1daf92105e07c34042db3c943998a1f3639764a37b7808a19b0403136f4c6f5084e4456389c4d05f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896192, "uuid": "3b731f66-1ea2-4b93-bb8c-c1764095ca4d", "value": "T1C9C53393A20A88F4F52663F07E26D82B4F7F3E778D7800A5648F39582B7B1D10997547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896192, "uuid": "9cb4826b-2654-4c7d-94d2-d6b2f7a37c7d", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896192, "uuid": "af24247d-1b73-4bb5-8eb8-657cd694c663", "value": "49152:86dauc6zDWCYsDrArF/bgPy1CdtGFeCIgcdXkw4fi3IRnwDOZ:bdauc6zDprWUy109Ce94aYqDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896192, "uuid": "8ab879f5-fad3-4a95-9eb6-e9f65881bcd3", "value": 2628640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896192, "uuid": "37d16e93-5090-4a42-bc57-60123456a671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896192, "uuid": "c9940c67-3901-4264-a7d0-64e4e5db57aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7372a7f-0c48-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686921775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921775, "uuid": "ea0c2a07-9735-4256-976f-66b107b751b5", "comment": "Malware payload (AgentTesla)", "value": "48e42c89ba458463fad2a22d346b8714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921775, "uuid": "1ead0cf7-b43e-4bb5-9514-1c533d9f1fec", "comment": "Malware payload (AgentTesla)", "value": "8709615933cffc3dea3a21afbca61c02d8e7ce47e76826c2e5d3ee7ed9d56a8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921775, "uuid": "485b2361-f16a-4cfd-9f5e-e049b7c998b9", "comment": "Malware payload (AgentTesla)", "value": "9b7b20feb53da086562f404124896b05af825a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686921775, "uuid": "30c67bf1-23e6-48cb-b5b4-95148330083a", "comment": "Malware payload (AgentTesla)", "value": "f35960c769e78e74b5d9e8efc5972e7d9ab6bafa1a9e248c8b1f40b4c156023f1cd503b1a4530485fe0ec245f2ebdfa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921775, "uuid": "aa226124-3dde-47f4-ac2b-4a2c3710392d", "value": "T1C545F1730153FDC9FB6B2E6A94081A456CA22857AB6CD2AAFCC403F762F5154DB1EC70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921775, "uuid": "3ed71742-7057-4f1e-9cb0-24480ec5e5b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921775, "uuid": "22cd668d-5a77-4e39-80a6-08203c34943a", "value": "24576:ArHuySNZp4MWnjax8zUW4X+dBTeopOwSPPLnYxYTZekf:4Gp2WCLde36u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686921775, "uuid": "96d90c82-6768-4823-adb2-7d8ffb7eb81d", "value": 1204568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686921775, "uuid": "0c7be68a-10a8-48bd-b11f-4f17bd42f447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686921775, "uuid": "3f4bd66e-4883-47b1-85cd-57be2cbc27b7", "value": "IMG-02133590pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bea8b2-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903069, "uuid": "ececcaa0-7d7f-4dfc-afcc-8a446afd8506", "comment": "Malware payload (Mirai)", "value": "6dc0c66db32ac131a4040f9bc66f8f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903069, "uuid": "7e903ad4-1ae2-4e17-a6de-98d45d1d28be", "comment": "Malware payload (Mirai)", "value": "89967793849d273ec0a41e93fac99c6e42f2dd92bbf8b1a997a65f0a279cf5ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903069, "uuid": "5077446e-d06e-4be3-89f5-664591c4729a", "comment": "Malware payload (Mirai)", "value": "04c0764d4a693bdbd4a83567d21bead8a4e0783f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903069, "uuid": "c6eb2bb3-b138-414c-8ea8-364a4e2b408e", "comment": "Malware payload (Mirai)", "value": "8d487f893db38300b11c5ff272333989ee82f5f23147d4867a8f771ffaaf1028731e018275c904a72871629e9af51217", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903069, "uuid": "80813ed6-278f-406f-9aee-455c386791b6", "value": "T18FC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903069, "uuid": "ea08f4a4-3a77-4b6c-9601-552444b45cf9", "value": "3072:6jVlyaL5JCrIpv04sWbttiEiTmP46aQyfPlfKsNb:yoCJCN4sWbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903069, "uuid": "d0344227-b89f-4fda-82ff-59b08e2b9779", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903069, "uuid": "edf69b6c-5763-4a2f-8e0c-57cadff9c13a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903069, "uuid": "e1452054-e890-4096-8ab8-5b515a96f58d", "value": "6dc0c66db32ac131a4040f9bc66f8f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c60248-0c28-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686907673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907673, "uuid": "8a056e3e-5735-499f-819f-d8a98f589429", "comment": "Malware payload", "value": "d716ecc461663e01c38296bd903f36ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907673, "uuid": "a45adabf-28e4-4638-97e1-47b6499de548", "comment": "Malware payload", "value": "89b6dfef925c2275b4ed2d0153e72b0fba99f08bcf9dcef751ae49692519c6a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907673, "uuid": "a280a69f-66d3-426e-a264-541c4490faf5", "comment": "Malware payload", "value": "d2f72cd4fdf048c9b7eb934349d65c2b9aeec993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907673, "uuid": "2b90901f-f6e5-4778-a08f-435364ce11b2", "comment": "Malware payload", "value": "5d2f93efb0e624071eb5fe7fe171491b642b03df0b4b39758d8ec5c0edf58e6189a81c7960052196c7f794577b50989a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907673, "uuid": "81c3fdca-cf7a-4980-bba1-6e8288aba469", "value": "T13D13E179130625E9D91180BD159703E0BD308BB77973EE0B89F45E66CE0789871A7EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907673, "uuid": "6112dece-35db-448b-824a-e2f661ee13bf", "value": "768:WicVXpD0B1+vzsieCAW+t0n4Qv5ZyOACXHWd+T4JgGlzDpUYsk:WinByzj+CH+OACXuVqY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907673, "uuid": "5fbb7ad4-b0cb-4a3b-9653-101039afb8ae", "value": 42008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907673, "uuid": "ae23db1d-c6f6-426c-8b18-1fd0109fb9b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907673, "uuid": "0f14fb3a-fa94-4be8-9dee-4733772b4470", "value": "SecuriteInfo.com.Linux.Siggen.9999.14106.14448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78965fef-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686894531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894531, "uuid": "e0f9a814-063f-45fa-9d00-0cc02f0b8227", "comment": "Malware payload", "value": "219cfb5aa87e78c9f053f5bc7816318a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894531, "uuid": "2427757a-4b94-4618-b49b-50111c25228b", "comment": "Malware payload", "value": "8b2dbd2c72e2491cdab41e352acb99f10c54b03152560e13e4367fc5ee3bbeea", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894531, "uuid": "8e0e73f3-76e2-46b6-8e91-a870c830d3ad", "comment": "Malware payload", "value": "40e8efe561c4455247af50cea961d6561b733fbf", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894531, "uuid": "821bbaf1-3b12-453f-bc3d-9c1a02ae33d2", "comment": "Malware payload", "value": "309141162efae40ef9666bae44603db626e3276380ca435b1155cd7c141387c8d643a9727813d0159066f5a536f5704a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894531, "uuid": "78099dab-65bf-46fa-825d-e2c0ef8072f6", "value": "T124900225354B5501C74219667816A683141944416D03160780B450855005615112E2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894531, "uuid": "b781df6f-890c-41bd-b763-ab44d26cbe59", "value": "3:fXohbTXMllmjgisn3kFtPn:f2bYEgn3kbPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894531, "uuid": "db717d40-f8b0-451b-b748-a57954c90f4d", "value": 53, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894531, "uuid": "59c9824d-8458-4926-b927-52319be5aa1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894531, "uuid": "df79779d-0f22-4afa-9222-1bc082eedb6b", "value": "NewXPOXODE2102812AGXJDE2106405.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fe09ce-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937018, "uuid": "486bc8c5-7259-459a-99b9-ca32ae15c2c1", "comment": "Malware payload (Mirai)", "value": "96b8e83af93112af0660d928f8bc9e61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937018, "uuid": "6d488e53-230c-4849-8c84-79ea3bf1ca93", "comment": "Malware payload (Mirai)", "value": "8cec0c88ad071c0aeb3ccf5f872ec3ca302ddd59d6c879f12c9119366c116950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937018, "uuid": "0f418d45-ba85-4eff-a5d1-1a4438b277d7", "comment": "Malware payload (Mirai)", "value": "fae2131afa0218b4e24daf4ff808b86d6371b02e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937018, "uuid": "ae79f7ae-b1b0-4919-8936-35631b9e0ea2", "comment": "Malware payload (Mirai)", "value": "530505b9bde1d996467113ae95ae428a4bb025394118bca5416d9423c20261eb0f6fbbbb71261054a34a9ebfffe1d891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937018, "uuid": "b45c0bb8-2b10-4c00-b5a1-b80ed7ad37c7", "value": "T176C2E044F1419E42DFEB29F03D40DADABB942F1EA9658E80229553C29B5D2B74306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937018, "uuid": "e7d7c7e6-0d4a-4c85-89f4-a7507f081f28", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7PVQ4uVcqgw09U:bam+AnKehPRa9ai4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937018, "uuid": "1b95ed0b-aeec-4590-8bc4-d74f8b9c8242", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937018, "uuid": "afe3a8d4-3652-4814-8482-96937b9fbce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937018, "uuid": "f9d03616-f84a-4ee5-9733-94ffb30f475f", "value": "96b8e83af93112af0660d928f8bc9e61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358190a-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686925580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925580, "uuid": "c5c0942a-f67a-4664-9832-1d044fd3089e", "comment": "Malware payload", "value": "72fba06e8f125448dfac107d7ae34042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925580, "uuid": "1e637b75-2cc1-4ca9-b7c0-b229f3e835f6", "comment": "Malware payload", "value": "8d3a3e012331fd34b3cb100bf610c951fde182d8ca41f7dbf9462c5bde448c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925580, "uuid": "6cdff267-472b-4e60-8f80-c6c1798db980", "comment": "Malware payload", "value": "9b591f000a0df2fcff30bc74867e388b860eda7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925580, "uuid": "fabb1317-5543-44a2-a3fd-684151042508", "comment": "Malware payload", "value": "57ce996a77e97cc608760cca36a73e79cb5707214de01b54c4b150bc0fcb95ced8154d874de63f416b4daab969faca8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925580, "uuid": "fa5ac032-b6bb-4f88-915a-7a032b1a7a04", "value": "T10F153348AEA1C6CFD5D1D9083386CE3D40B4B15942B2EF7A1D88F2D3D867692CA516C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925580, "uuid": "1b382070-9ddc-40e7-b8fc-4d468d541054", "value": "24576:udWxwDPpb6hc0A4pKwv+CrpFgSSDCzmeJJ0muLTTsNLzT:aWxGPpeh9vtrgSSDfeJJ0wLzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925580, "uuid": "4079bf71-a029-4c16-b2c5-654b2ad9ad9b", "value": 923391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925580, "uuid": "59d570f0-482e-4411-876b-4ac870a28063", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925580, "uuid": "416d7ca5-622f-44c0-b84c-d467ffcffc04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1e3f08-0c9e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686958481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958481, "uuid": "70fcbc17-ffae-4ad0-be27-21952b195035", "comment": "Malware payload", "value": "069e56ed9de2f23f787c8a30b5ab4298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958481, "uuid": "142ca3bd-7d91-4e74-877b-8e57466c8f19", "comment": "Malware payload", "value": "8d7c2f9265d24f6f5c539931ed177f2d48380bba5803909d711b404fc57c0ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958481, "uuid": "d8226c54-1727-4ed9-a323-161095dcc192", "comment": "Malware payload", "value": "637c3a622bb5a4e6852c0b362f812cb953cfabab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958481, "uuid": "e6a6cecc-704a-41ee-8657-765b3cef2e16", "comment": "Malware payload", "value": "09bc29a0f1fdebad5493df79109d341c317f7bebaa0324adc4c0016709e1c5f21fd19ae4725022d460bfd205ca660766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958481, "uuid": "f830330a-a3a5-45d0-971b-8c5a27713536", "value": "T16E54924392F23D44EA36CF739E2EC2F8761EF6518E497B6D51189B2B04B10B6D263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958481, "uuid": "4b6cb7c9-df0e-41c9-8b46-88a700debdfd", "value": "f719d133eb0a7f30a0b9bd8ad8b269ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958481, "uuid": "f9fd8ee3-9bf5-44e8-98f7-319e369b17f4", "value": "3072:53n5O9iijFg7yyItS/4LqYeh/q8fv9zP/H/7Y56ewh5TG2kV8amjs:vO9ljFgQtpmP4Q3H/ztBGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686958481, "uuid": "636f3a04-e8f1-4d81-b605-76edc7d8c1c1", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686958481, "uuid": "deeed356-d469-4a01-b753-93822b5d8157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958481, "uuid": "fc5e246e-69a2-434e-95bd-b62cc41332a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8b6b83-0c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686904632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904632, "uuid": "70439935-23aa-40da-b9dc-d1df80d189ac", "comment": "Malware payload (Mirai)", "value": "fcd7ed2049830259fae8e82e84bda0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904632, "uuid": "b2b3a70e-2242-4985-bd57-6a4e8ad0cf73", "comment": "Malware payload (Mirai)", "value": "8d8645ecefd4a2dea53ed4e038befefe0759c13fb0a1af8f2bcc433a7f0c2106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904632, "uuid": "085448d7-e7d9-4e37-8285-84628c8c67e2", "comment": "Malware payload (Mirai)", "value": "1d464e3de831b4d00c7a826440a212752340f49a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904632, "uuid": "9cff8b4f-4dd8-46a9-a48b-1dd4fc42bfc5", "comment": "Malware payload (Mirai)", "value": "305f06a0d8464478ee076433200a93cf047f52e88049c31c43341639e7c0f7abb70b223a9df8eae1c2a98cc76165ab91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904632, "uuid": "09c97b3b-eae8-41b2-9bc9-38d20d5b191d", "value": "T1DC13F18E6B033980CF28C3F08BB2476C39448F1895B7DC539759E354CE469A8BA93AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904632, "uuid": "1b70c4db-e990-4200-b601-602d163a7aad", "value": "768:fmS64P9OXH+FhzTPsB6F641x+I5SFwFePd9/2jBVqbH8FjJgGlzDpbuR1JMg:eZo9TF9rsv41xF5SFIWPKXkH8FZVJuig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686904632, "uuid": "5255ca4c-6e44-44f7-85fe-b947dea38915", "value": 44768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686904632, "uuid": "33091d40-a833-4229-ba0b-eb9543ba6637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904632, "uuid": "9a8ff006-24a2-4b35-830a-cb66f4b0f0be", "value": "SecuriteInfo.com.Linux.Siggen.9999.20300.18980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba789cef-0bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686876602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876602, "uuid": "9ae0d2bc-5cf6-43d9-b4d1-d99120301926", "comment": "Malware payload (Fabookie)", "value": "0f99b6f4a643dd62adc0d9fccf87adc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876602, "uuid": "887f0fcf-9a65-41c8-b2b4-2b0dcea7c257", "comment": "Malware payload (Fabookie)", "value": "8db91078064ffae143887f7c930a9cfeea87fa0acfe629f7cfb08794c195bd04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876602, "uuid": "baac0f31-d8d0-459a-89f2-0f6e73162aad", "comment": "Malware payload (Fabookie)", "value": "a66a3ae03357e8edd68867f358b04ad70ec3cce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876602, "uuid": "5b5598d5-ed84-4008-a1e0-050bdfa1f850", "comment": "Malware payload (Fabookie)", "value": "035845deca4ef22dab50b81a61d161e076d98277712b97ed51cec097640957f569232b68dfe28a2127aeb09cbe950185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876602, "uuid": "dbe03b36-d7f5-4a5b-8222-6266ba893f1c", "value": "T13B349E12FEF06C72D56687728C6AC6E43B5DFD908F18679B22187A1F09F11A1C57233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876602, "uuid": "fef10d36-a9eb-4f52-a1c3-4ec3855dacc7", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876602, "uuid": "33e6ed8b-d0e7-4686-98fa-21e848cb9cec", "value": "3072:DyYf8kxVSSyeKzWZOl92AdVpnf4rT7SlvalbqwhIX1xf5oVWoHIh:7f8WVSSynWZnAxnfa/Sligwqf5BoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876602, "uuid": "5d4c30d1-ec33-4afe-9533-00211fdbcdeb", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876602, "uuid": "9e7b35e0-6f04-4003-9b61-5f22b9a6dc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876602, "uuid": "f28fb307-a7e0-40d5-8674-2b8974fdde42", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269dd5fc-0bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686889239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889239, "uuid": "94a0f39f-b457-49c3-8e10-215348a20fdb", "comment": "Malware payload", "value": "8adb6bf170d9e58bd51021619c8d74a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889239, "uuid": "6ce3c708-8f50-4be4-adb8-5dec5997f5a7", "comment": "Malware payload", "value": "8e12d8cb25a85392d8e14d429b725c635776731d1546ad5d8c88afb09e8e2856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889239, "uuid": "94acc9b5-38c3-427d-a290-b96c724f4dcc", "comment": "Malware payload", "value": "fe37f27bb1c348e21ff0f656ed3efd100627f199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686889239, "uuid": "d3c85273-85c1-4cbe-910f-18d5f09e257f", "comment": "Malware payload", "value": "bc6a862cc9e994244985c17f14c392ab7fd8abfa26ca05a2be55348813dc1e5ab8e096f420658039b25ad2e1839f1a66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889239, "uuid": "f3cb8732-81d4-4e9f-8438-9b9d0a1935f5", "value": "T1B2E54B66A35CC17BF25E6CF9C5B75D7EE244B2130AF108FE5E88AA0E23DD610D8148D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889239, "uuid": "4deb1d7b-7b90-4354-ab76-b04c58eae5e4", "value": "589cb6e0bfc0f2aea09b980a40669aaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889239, "uuid": "43f0c988-604b-483f-b1eb-0787d8a02d48", "value": "98304:0ahXe72/ZtsBYxnI+mO39DhslFZgypfOcdqVlkRYFu:ORY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686889239, "uuid": "c591c7e4-775e-42a5-94a2-1142a2a3a47d", "value": 3180032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686889239, "uuid": "96f24694-173a-4b7c-99a1-8256dc342a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686889239, "uuid": "65af6ab2-8541-4d64-9ddf-860d592e7d30", "value": "8adb6bf170d9e58bd51021619c8d74a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217fe804-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686905981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905981, "uuid": "8d646de4-f2b6-4072-ab69-eece650b4855", "comment": "Malware payload (Mirai)", "value": "0cecf372835f6d2598a6f108989a61fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905981, "uuid": "4d2dc7eb-21db-45af-ac69-1f6108b493f9", "comment": "Malware payload (Mirai)", "value": "8e4f1fa81341f8809be3a22c51dcdb5ccc841b40b4e6a00229c5aae590cc2d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905981, "uuid": "28087f24-6361-408f-bcb1-b072d76642a4", "comment": "Malware payload (Mirai)", "value": "a2d57551004b6d21f8997b0c9c0398aa61dff924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905981, "uuid": "0f08e416-0ea1-4551-a364-c9c931ee0e9a", "comment": "Malware payload (Mirai)", "value": "09e5b7e8136d1547a541a14975aaaae91dbb06d5491893b209e84f648242d159e48de2b2b97d187f3207367eba592cef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905981, "uuid": "1709816c-3df0-4099-a05c-188c9c8c4e39", "value": "T1CA03E1AEDCA871D4CDBE54BD415C522324987D80288F5B4E6B551CEDFB22B4FB80B0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905981, "uuid": "7b29028f-661e-41db-8984-baaff8fd6083", "value": "768:VVdKHtkPKJaPzlu/+1RQPE5480v/8gBkkPx0brTPIehNyyKgWMy:VqHKPKkLlFSEf0H8gdPxGTweF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905981, "uuid": "68d608eb-a3f1-47fa-a0fa-c442441b5594", "value": 38488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905981, "uuid": "f95e4292-0845-404c-9832-356b391caec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905981, "uuid": "765698ee-95fd-493f-8bd4-e87b350d3e5e", "value": "0cecf372835f6d2598a6f108989a61fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7ebadb-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897547, "uuid": "4b25c791-21bd-4444-885f-bacf71fb7b12", "comment": "Malware payload (Mirai)", "value": "c8cb3f7e08735c6113fe8d0cb5a30067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897547, "uuid": "d7744d75-2a42-4e29-9cc5-cdb19e3371a6", "comment": "Malware payload (Mirai)", "value": "8eb96a1cab6b25337bb5d135d77375812a713b22aa10a02c96379be1dd3f71af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897547, "uuid": "e629b614-9778-499c-829b-1cb7fc76eaaf", "comment": "Malware payload (Mirai)", "value": "09291dd732bb7b320ccea78770405374abc5e7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897547, "uuid": "3869be5a-7bb4-4012-b027-7ee7eb96fd00", "comment": "Malware payload (Mirai)", "value": "938d26907eb9c4457788b8f3664836401f45908a26f30a87b277c160eb2e7db578cd794bfdfff3e25ec53a2f1ee179dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897547, "uuid": "9cdc4fcc-4912-424c-9eb3-8d4c37b9a4b9", "value": "T1FF7302F801EB3491C6B2803FAD1B22E2BEE0C5947B7547A4FAA29C719D5842F64539D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897547, "uuid": "1cb8cfee-42c0-4b03-980d-2a216631e8c9", "value": "1536:KKt+ctbxEjbiDzevk9epLLEtVKN7Our/ILOUjO9ALj:jtDcbiXe4gEtAN7OuLc9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897547, "uuid": "fc20f79f-f46e-42d4-821a-8a6e14aa4a9a", "value": 78220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897547, "uuid": "4a0b50a7-1a6e-464d-b40e-bf337356f64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897547, "uuid": "3f2b5ea2-038a-4ecf-ad6f-f8a8f064496f", "value": "c8cb3f7e08735c6113fe8d0cb5a30067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cb422d-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900692, "uuid": "b2cf5f4e-c941-462e-b805-e55679760064", "comment": "Malware payload (Mirai)", "value": "6c0b96b6eaec54371c59c9dbc3192355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900692, "uuid": "459f7f0e-8450-455b-911f-f25cb5932ced", "comment": "Malware payload (Mirai)", "value": "8fbeb3ab7823636ec675a9463e10f2cf8e9c986a8575459ca810963b86cac480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900692, "uuid": "a9c6489b-6658-44ba-9c99-bf003fb3cb54", "comment": "Malware payload (Mirai)", "value": "909de8637e56806312e73421b3b01a32fe1c4c3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900692, "uuid": "90253694-30a3-4256-ac79-609662443210", "comment": "Malware payload (Mirai)", "value": "dc55b071c62172c114b4946b2ba99e2268e5295264146606705d938a98a334bd63c64fb24296ea0a05e56ac1252a8fcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900692, "uuid": "f7159f76-4598-4ffd-9e64-beac9de548f4", "value": "T1E2533AD9B4028E3DF88FE9B984160E05B92023D112931F276BABFDE37D731659D12E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900692, "uuid": "7cac70d4-a2cc-44d7-b924-e1224a5c9981", "value": "768:0/eogBUM204+EkRD7HGneYPBQ9VlfgFHBt1euA8B8vxCx7Uj9fX4m5RobjE3M:mYPEkRDDdLCFBt1XA8B2SUj9fom5J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900692, "uuid": "477ab7ee-d0df-40d0-876f-c6610070f399", "value": 65108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900692, "uuid": "5f1d3303-0022-4101-ba7f-fc48a5f81a6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900692, "uuid": "1d6dbab4-0705-40c6-8324-809642eb98ae", "value": "6c0b96b6eaec54371c59c9dbc3192355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a655aa7d-0c9d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686958173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958173, "uuid": "c186bc17-78fe-4321-ad8b-7970f1e9e81a", "comment": "Malware payload (RedLineStealer)", "value": "dc808cde87c24e560944b26bb9e2901d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958173, "uuid": "c0f13a0f-03b7-4ea7-8f8f-33b50ac08885", "comment": "Malware payload (RedLineStealer)", "value": "90012dedd673232e449e337e4d900a2754f3eb21103c62e799ca350eeebd37f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958173, "uuid": "e59a06d3-5411-4274-a9df-9e94db8061ad", "comment": "Malware payload (RedLineStealer)", "value": "17da8aa1d884b04ae2e130660ff09a87183b812f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958173, "uuid": "3fff2652-9044-406f-b59c-50a2be4739e1", "comment": "Malware payload (RedLineStealer)", "value": "6c7b0d231aa641c2f29e7e91204415d0e1ad510f659a977fd830d89d3f1b54ff682508c95c779c64f44e365a034beb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958173, "uuid": "c3c1fa6a-d196-4d23-82e7-4d69e907c56e", "value": "T19F84280392B23C44EA76CF729E2EC6E9361FF5618E59B76D51189B2F04B10B2C763721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958173, "uuid": "9aed9841-f26f-4da7-a5ee-7c2169011db9", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958173, "uuid": "09bf551a-06d9-410c-9313-fad88a3586a1", "value": "6144:d+m/cGp4CaE/1GnZdUZyAUyHjqSSHbtaYM0RBh:Um/cGpwEdGn3OZOSS7nMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686958173, "uuid": "86dbd5c6-f537-4f04-b441-e7110a10973c", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686958173, "uuid": "16e184b2-1d8c-484e-8abc-e2ccc409485a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958173, "uuid": "78248985-6366-4027-9dfd-4e0056e75ea2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9b51ce-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914348, "uuid": "a56679c9-6989-41a0-8340-33b47f3a61ff", "comment": "Malware payload (AgentTesla)", "value": "b9e9573b00d23755a614b947e637fa39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914348, "uuid": "36d506f0-7745-4239-a828-42e45d2aeefc", "comment": "Malware payload (AgentTesla)", "value": "90af14f7e125ba4bb6b30152719708b262b08d77b30b02d02ee136d2acf8bfb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914348, "uuid": "418ea0a7-51d0-423a-9cfb-c495460159e9", "comment": "Malware payload (AgentTesla)", "value": "7de1812bdfcd057c51301945c78e62b1922e0793", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914348, "uuid": "af10acf3-7159-4173-907b-520580983490", "comment": "Malware payload (AgentTesla)", "value": "75ea51a38d00afa575f9a302b7cfbad38c4c1e0d5589bb7723f2577b50bb1ff33c6a43d1aec2432ad9f5a89ef308c8ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914348, "uuid": "cc66717d-ab85-4603-a196-5c9729d6d818", "value": "T19205021522C48B2AC43F0BFA84505530C7766366F567D7260CC2B5FE1E62BD3968BB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914348, "uuid": "de85bfaf-2371-4637-9fb0-315a0538c98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914348, "uuid": "61dea150-ba5d-45dc-8cb3-5226986effe8", "value": "12288:2NeLBa2iNx5LbzIu9+r9GiCyZemvtoeHLFST55z8ovFnRMfgWxJi22DF:Rla1j5LA9GsvtJrdupRsnJiV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914348, "uuid": "de7261a5-7e78-42b2-9c58-ef95ab63e4e2", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914348, "uuid": "9e6705fd-a4dd-40ff-af6f-fc56d0450e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914348, "uuid": "c6777270-e1d1-4ede-8b18-86c2dc12b28c", "value": "DHL - OVERDUE ACCOUNT NOTICE - 7373882900-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c938f04-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686914267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914267, "uuid": "1a488267-adc4-455b-818e-cae965b0b26f", "comment": "Malware payload (SnakeKeylogger)", "value": "ff8a153009f9bafc67f05412cd8c01a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914267, "uuid": "c3cd2d2d-4bea-4ea6-bfb4-378eb2ba0138", "comment": "Malware payload (SnakeKeylogger)", "value": "90b37ea81aba9787a883970ff011dbbf5da729fc915bf3dc104704111fbc2848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914267, "uuid": "541210f8-8883-4f93-8e18-60108d6de58d", "comment": "Malware payload (SnakeKeylogger)", "value": "f198f0e7dffd110cc42e8eabcfe56d61b6ac698d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914267, "uuid": "c101649d-3e15-4b46-acff-112107a7425f", "comment": "Malware payload (SnakeKeylogger)", "value": "87359dd7239da86ddf468826b8d1044a3c5d5a025bb83dd6ef5017765ae0e7798994cb054e17a357cdad3659a8581589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914267, "uuid": "9a7764b5-c2db-4a60-b215-66e039c370ee", "value": "T18FD42388D763C623C48327F6A9152970433B6BE5B465D6434C8373F9DAA1B1ECA316E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914267, "uuid": "3ec7f27b-1cd5-404f-8285-e0797c31ad0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914267, "uuid": "c8cd498c-0770-4bc5-91a7-de362d2fbe08", "value": "12288:g5LbzIu9+r92aY0uhVMgTywYEJEBdIeZTTqNJ/f:g5LA92JXagLYfdIeqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914267, "uuid": "3000af9c-ef13-4bc8-8927-9025aa1c1284", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914267, "uuid": "892161a2-0ed2-4977-a9d6-50db8a0a4bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914267, "uuid": "ffb16f52-a389-4111-863b-8af9170496d8", "value": "m2LTpwoAtDGa5Xo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad94ed2e-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686913518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913518, "uuid": "03b1eb25-d3ba-4979-b4b6-d203c55de5eb", "comment": "Malware payload (zgRAT)", "value": "3f5cbe1d7a943fff25f3cfea48de4da6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913518, "uuid": "6ff904ce-73a2-4209-a755-9b72de398a0b", "comment": "Malware payload (zgRAT)", "value": "9164003976d725dca53976f6059a6c60b9b98007466990946f4ed7da6c488842", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913518, "uuid": "c287117a-ab49-49e1-abd0-ac464e078681", "comment": "Malware payload (zgRAT)", "value": "e7e859a1878d27cbd12868bb85e93ca34bbadac4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913518, "uuid": "81b9a3af-8381-4b0b-a489-658b8c052525", "comment": "Malware payload (zgRAT)", "value": "24bf33a40094c7ce6b0967659b655bd84a337daf9bc451c963cf09029e982ac0b2f807efe43f22fade058b7954251b35", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913518, "uuid": "8cb72fa6-08f5-4308-8bd2-9c47b3266fd2", "value": "T100041282C7985725A2D18920A8F3E1667A39329E4E0492DF053C55FE5CD0B7BAC34F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913518, "uuid": "7bc10470-5ca9-49ac-abf8-d11919ce2fd7", "value": "3072:uKA+v2zsLn43wBuLW4oyklWzIu/Mc9ILAzQzjPRxL4lw/dHuOP2:l1C1W+cVcGUzej5pfdHzP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913518, "uuid": "855f593b-a350-4fa9-a34e-05595cc79a8f", "value": 186212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913518, "uuid": "310155c7-1601-427d-b751-e70a9df01241", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913518, "uuid": "0a331efd-45ef-429c-b1c9-96846a112ea5", "value": "APPOINTMENT LETTER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37ec094-0c7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686944102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944102, "uuid": "8a608b5c-ecd7-475a-a2ed-680d0009f3b8", "comment": "Malware payload (Amadey)", "value": "a1f24b2556033b40402b1ed67ff30413", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944102, "uuid": "9ecb6407-38de-4184-a2d5-11fe49fdb6a1", "comment": "Malware payload (Amadey)", "value": "921c3cd2cc118cfa6fafb9e480eb5e71f545baed0b3a34bab6a30471e1ada56b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944102, "uuid": "fd8aece0-2389-4c70-b8b6-4c30715b737c", "comment": "Malware payload (Amadey)", "value": "dec509bc53892a283bbf85d4f58bf224929f7ec0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686944102, "uuid": "85ea096f-3419-4930-a3c8-0d6869a0ba7d", "comment": "Malware payload (Amadey)", "value": "fa00735147389f21831fc3c4d776f81ee4b502e9f12be1c4304273ed5978272b174e40c3a59a4680e35f7c0efe716d5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944102, "uuid": "4c25fea9-0a81-4ed4-8e12-3705be8d16a8", "value": "T19D54C503A2F23D55E936CF729E2EC2E8765FF6518E59BB6D51189B2F04B1072C263720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944102, "uuid": "0b1bc310-aa56-4156-b601-7c567fcac274", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944102, "uuid": "df1126d6-85e1-443b-920e-300dc2769895", "value": "3072:F31NoA+euzDS3H2KtrNdyDPRnmI8MjVQe5rz/4Q5qYwh5Tob:poA+euncHlUDPRnFjeogDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686944102, "uuid": "160e0301-3f06-44a6-a47d-3442f6130389", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686944102, "uuid": "ef959e00-2abd-4183-b445-1dcab3c9333d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686944102, "uuid": "0fa11872-37ab-4463-8111-cd1f523c2dc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c3652d-0c62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686932864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932864, "uuid": "9b8cc978-1fca-4f0f-ad6b-84c5788481a5", "comment": "Malware payload (AgentTesla)", "value": "21d1163cd9edb6ae1478f2695e70836e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932864, "uuid": "23ac693b-93cd-46b2-9c84-8ebc9eab38d0", "comment": "Malware payload (AgentTesla)", "value": "92e20368143782c5dcd729449a940ae0bd670adb81136a2430f58c8cc9762851", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932864, "uuid": "644529b1-8958-4bab-a1d5-6bd22b89bfa9", "comment": "Malware payload (AgentTesla)", "value": "1e18d438a23c0aa9ddf3df4eb81bc0a496e7b166", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686932864, "uuid": "5814f5e3-e5b3-4de4-b714-36662840c316", "comment": "Malware payload (AgentTesla)", "value": "988da45a2439c8d248d57c0778b3b6a118664446226a572689c2912404b23c17bb1fe32f8806f4d7bd86ea63b8ffdae3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932864, "uuid": "442b93e5-a0c7-4d48-b0b6-441699560668", "value": "T1CA25125D0EBA842FD8563FB84D22A2B6E9EC5D85396685C38F83FD9CFC79D8C2840055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932864, "uuid": "9162dc28-dafa-4a04-9175-2dcd25ea6876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932864, "uuid": "625fb125-dad0-475a-9afb-85bdb953873b", "value": "12288:ADPWR28Le0cY+Yg9fb9ncA91c+yMBMWR7B0uFN5UQLQ9Z3htSWC9oF0MsLjmMj:Aj+xL9Rk9WA92+3uI7RNGQLchSWhsmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686932864, "uuid": "d2955c8c-4c75-49a5-a34e-6d112494439e", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686932864, "uuid": "1d5933ca-905e-4add-a723-24ee47d26145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686932864, "uuid": "f53f5075-e84e-47cf-b287-e76cfbfcc3ec", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3dc66a-0c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686904633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904633, "uuid": "afff2840-ff1a-48ee-9ae5-1c3b92979067", "comment": "Malware payload (AgentTesla)", "value": "e7782be3cd26ebfe430dddd5f5dff4a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904633, "uuid": "c68a1f18-18d4-4521-9ac2-a5505e7d13e4", "comment": "Malware payload (AgentTesla)", "value": "933c592dd1ace20eb58174b78096b78fa87629bf6594ab26c74cd119ad9168c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904633, "uuid": "926a27d6-1adb-4bd1-acd9-0fecc575102f", "comment": "Malware payload (AgentTesla)", "value": "db79d1e6d7ccaeb2985c3eb5c741de288f4a9192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904633, "uuid": "ee89412a-97e2-49e8-98cb-af6eddb018a5", "comment": "Malware payload (AgentTesla)", "value": "ff2d3bb5a29503db525a3aafdf10543d807b283a1ac7902ac08668788bd06a27dfd6e0ab13d9b90fa06acdc0d56ba029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904633, "uuid": "22b1c340-4ef5-48b6-95e0-bb40b44d3951", "value": "T10E045010FA07DC76FA1142353BA5F1620241AD23B959CE562AC3B20E07F7B517CFAD9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904633, "uuid": "d876a577-5e59-4fe5-a85f-084007d2cacd", "value": "3072:/zkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA2XN2kTGVwIHQDlhs3zpfWLSCZhXNs/:IZ+RwPONXoRjDhIcp0fDlavx+W26nA2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686904633, "uuid": "ec9646de-0522-4df2-920e-5eb516e8e232", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686904633, "uuid": "3776d66b-f092-47c1-86ac-3b951ddddb58", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904633, "uuid": "8a366452-b803-4dc5-8723-e86783da4fb2", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.Gen.5259.26883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19044550-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925724, "uuid": "65cbc325-ea76-48f5-87e3-d1bba23c2498", "comment": "Malware payload (Mirai)", "value": "e0270da26948aa8d38de362d4a70d66c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925724, "uuid": "983d6577-bfe3-40f7-9fb1-d8e904ff3b7e", "comment": "Malware payload (Mirai)", "value": "9368b4020daa65abee5a3491e1f64fe5f339d2bde5724a73f5e2a98aec5401ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925724, "uuid": "438c61b0-a284-4348-a0f9-1d46e31531c3", "comment": "Malware payload (Mirai)", "value": "7e77bdc55bdf2c9a6b82fc04c992f2920873069a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925724, "uuid": "756948c2-c1c1-4378-9804-247d4a1b85ec", "comment": "Malware payload (Mirai)", "value": "64bdaa2a2b77f603bcfbbbeca8ed178d32b5d300e0d448da3367026ed9fb5e1c1351cb21e6621b0b29850e31f62c52be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925724, "uuid": "fd342310-759a-4c71-a492-c25ce4d95dfd", "value": "T18E5301D2453230AAFCE44A6AB23F1183C5DD0770E9593599224B3773EEE366283194FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925724, "uuid": "9697054c-359b-49e3-9ac0-023d95f41c34", "value": "1536:hXpqQ/GiI/7WCjYz7hXEXI7caabFZjO/TX9DTpS1bjSycLaRFN:T7/foCS0EXI7cDX6tpoTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925724, "uuid": "f9ec5261-bbe2-424c-a87a-811003bd689c", "value": 63228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925724, "uuid": "ac5503de-95f0-4932-90d3-a0f7165a35f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925724, "uuid": "236fa9e2-7a9a-4e94-977a-af1a186abea7", "value": "e0270da26948aa8d38de362d4a70d66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22439207-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925739, "uuid": "cfc06471-5473-4541-bc76-3873438e6029", "comment": "Malware payload (Mirai)", "value": "adde316fd9b9e6a0608140a0ddeefcb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925739, "uuid": "c2aa5353-95d1-4801-96f6-1886d8637982", "comment": "Malware payload (Mirai)", "value": "95a8d26bb0ca637c5c88270689501e20476154d3fcef5be3178a12d194ab1f55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925739, "uuid": "59c67e2b-44b2-483d-9f5f-33300e40d290", "comment": "Malware payload (Mirai)", "value": "926438eaac0ff5631c2e74f1b83b40eb26e3c75f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925739, "uuid": "13556826-9fd1-4f38-b2a4-b1fa69654d13", "comment": "Malware payload (Mirai)", "value": "54005adb978b25c32b96efb3acc97a5395780fa8abb2db904d1aab99b8bc7df18d21169162bb766e5989b346c9650088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925739, "uuid": "1272e57e-1097-4c74-8cc1-8499a5bf02ba", "value": "T1EE03E070E72994E3D5A4487CDE2B904B37FC87F8D16F2A24212E8A9548CB4CA77FD445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925739, "uuid": "92055c77-d8fd-40c6-9e77-40f6de2ead35", "value": "768:T7TC44QZMhzgTQ5av3fFgSDMtOmTfL9EfOYRX1WrqYJCq3UIKe:+44QS2Q5MgqMhTfukbH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925739, "uuid": "38b0cf07-c868-4ba8-a491-5af252cefcf2", "value": 41052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925739, "uuid": "fe51201d-5445-46e9-bbe5-2dc6f9678746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925739, "uuid": "7100370c-1baa-47c2-b20a-63226bcc5594", "value": "adde316fd9b9e6a0608140a0ddeefcb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d82dc-0c6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686938287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686938287, "uuid": "1e4fbf0a-f256-4b84-abf5-ac6f703a27da", "comment": "Malware payload (Rhadamanthys)", "value": "6eafe46e975d113b73104e234b184ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686938287, "uuid": "521aafed-bad8-4390-973b-ed772e9b004c", "comment": "Malware payload (Rhadamanthys)", "value": "95bd28472a3dfcffa46dedad1547e5ac3fcad81d35af34a5da524aa380523415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686938287, "uuid": "7f3fd010-b44b-4f96-ab2b-34f3bc7a435d", "comment": "Malware payload (Rhadamanthys)", "value": "d16abb08fb6531d251d1a42daa2dfadfdcdb8e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686938287, "uuid": "8e0d10e0-e14b-4a45-9e78-543feeaa701d", "comment": "Malware payload (Rhadamanthys)", "value": "e896dab2ac15e8ab3c92d2cef0ca6294ba58fa1f01fd56f5e6ddce94de767dbbc083f90fb84bda7e0801f6e5c5761b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686938287, "uuid": "b63629d1-73ae-4fe1-be9f-fbc648be3a20", "value": "T1F8C48D13A2F27C55E9368F729E2EC6E8361FF5514E19B7AE52149B2F04B11B2C273321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686938287, "uuid": "d9cabf2c-782e-4f6d-ba06-7c035ff50df5", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686938287, "uuid": "0979073f-3b9a-467d-892d-ff72bf82d271", "value": "6144:mXR4IDc+1Z9z5Ali1Th9MEl1TcryLU+gAhLtVyXyzgkXHDd8wyUBkCBb:+OIDc3i1Th9XP7AW7z9pyU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686938287, "uuid": "1bd216a3-34d4-4353-a784-ef355155f7ef", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686938287, "uuid": "870d185b-3313-40a8-844e-b0fde0d81bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686938287, "uuid": "ac3a5e26-e511-485a-bfcd-1ed940c7add9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc858e7-0be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686876902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876902, "uuid": "0ae4c172-ec44-4c0a-a37a-c23ac4bd000a", "comment": "Malware payload (ArkeiStealer)", "value": "1440f8d085a878931b79ece197e4f18f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876902, "uuid": "deb18a3c-d1d8-451c-9353-0851b030147a", "comment": "Malware payload (ArkeiStealer)", "value": "969dbe828eb2360ea534391879163f2f91012c265e2c2f6e0f4ccf152912e5dc", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876902, "uuid": "3b6c6401-d2b6-417f-a8ea-079529ca0db3", "comment": "Malware payload (ArkeiStealer)", "value": "6d6adfb42d091ea212115ad730f82edf6e5f1b93", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686876902, "uuid": "5f8b8a96-1b5f-4fd5-b6a6-d89aaa5a0a95", "comment": "Malware payload (ArkeiStealer)", "value": "ed15e24c76556ba16a3732e8afb35ea01092968b62d3a6cc6a5eb7d26bdde2e167d875cb3131bc9e22f7ac55e5161ea8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876902, "uuid": "09bbe702-1623-4b09-b18c-d75afa786e33", "value": "T1A364D05136E0C432E6FF85305931D6E46A7BBCB36AB185AB33C41B2E5C722C19E7531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876902, "uuid": "a6ec75a0-20f6-457d-8937-8dc55af28cf0", "value": "01fc29f6287a25b9bdcce5f6d1717e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876902, "uuid": "563cd3e0-246d-483e-ad39-53327db6dbcd", "value": "6144:A+zHdWRNjp2/zd9SMecM7ywO/Y3oRX/mWtJ4cRwth:Aa9Wfed9feX2LQ3oh/mWtJYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686876902, "uuid": "b2427379-1ba2-4633-b515-b7f6b7b6cfad", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686876902, "uuid": "1b47e562-b7e3-4c50-919c-53ba4e7fe267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686876902, "uuid": "dd591737-7b76-4d5d-9123-f1eca8e39116", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd6a03-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937005, "uuid": "9cb8986c-bb8e-44ce-9f66-283f50fc9895", "comment": "Malware payload (Mirai)", "value": "fe4bfbd4a2d7a411da8a6870d58fc48a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937005, "uuid": "cdeef03d-0cef-44ef-bf1e-5931daf7898d", "comment": "Malware payload (Mirai)", "value": "97201267bfaa40d71b1bf50b15fca732be96f752d469c79dfc0304fb367b0a96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937005, "uuid": "eb2e8986-9df9-4deb-910c-7cd640b1c45f", "comment": "Malware payload (Mirai)", "value": "9731d30e18b84235b2ffee157778afec66970b9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937005, "uuid": "aac86d1a-a96e-4aef-9c5f-bd887137c4bc", "comment": "Malware payload (Mirai)", "value": "631f244f04440d7b8f926b122d20b8fae35df32d432d86db6c58629aa553de0318cf1c785206dc4ca690f28d91063771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937005, "uuid": "909c8f23-3ea3-4133-a4e1-58cdeae0d86e", "value": "T1CD536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937005, "uuid": "452a5c7f-235e-4973-a323-586d057ba3dd", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8R:p5VHV8I9cK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937005, "uuid": "ee0dfad3-b9fa-4be3-b55b-faa883869497", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937005, "uuid": "f8da8142-c2d9-43d9-8197-d3cac4d022a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937005, "uuid": "fe3cd06c-affc-46c6-a8da-39c6109d4147", "value": "fe4bfbd4a2d7a411da8a6870d58fc48a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35da413-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908910, "uuid": "2eade7d7-afd4-4f64-899a-8a0d6c44b6d4", "comment": "Malware payload (Gafgyt)", "value": "b6974fe55c154b3b34b93e0046aa13a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908910, "uuid": "e589e9c1-dc3d-494b-a1c8-991723692a4c", "comment": "Malware payload (Gafgyt)", "value": "991336c9aab218dcf7dadd92daf914fe364945b7536af27c80efa0a640a72ef7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908910, "uuid": "1a2139e3-0da0-4d59-8d1a-ace509876a59", "comment": "Malware payload (Gafgyt)", "value": "3d59760416cd7e3fa50a0a5bb13a813c5e251fa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908910, "uuid": "b7dd49c2-25e1-4bae-9906-b5814b45e248", "comment": "Malware payload (Gafgyt)", "value": "f3e296b03aeeac79508bebed1b5e47b112a01dfe9743d8249d37d89d84906fb596f2bd6ca1ca17f6cc6bf79ca1aa00eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908910, "uuid": "712621dc-3333-49da-a56e-4edd691083af", "value": "T1A2933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908910, "uuid": "5cf8c210-8817-4769-b265-24aa389e480e", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emtGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8rDeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908910, "uuid": "44ac4b13-86b7-4a6d-ae59-d0ea05e63691", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908910, "uuid": "79d69215-a1be-4b28-941a-94172c83b39d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908910, "uuid": "2e1fa7d7-036e-4a7a-9659-ca877c1fccf3", "value": "b6974fe55c154b3b34b93e0046aa13a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f398098-0c41-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686918459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918459, "uuid": "9ccfeef8-449c-4325-bf7c-8b6359d79d28", "comment": "Malware payload", "value": "5c87897bfda33b630277f7bbcadbac0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918459, "uuid": "44b396ac-7b0a-49a3-9e38-d0c80a3147b2", "comment": "Malware payload", "value": "99247ab7c88789cda5f3d4f37067cff5adabee69e87859bd6023e353d39fb81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918459, "uuid": "0571eebe-7ead-4520-a918-3c989d0e2192", "comment": "Malware payload", "value": "c059fd6eae066e16c0779ba39d122e61ce8129b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686918459, "uuid": "6ef0d0ec-a343-4353-b119-6d17614c1f9d", "comment": "Malware payload", "value": "93544aaffc39167edbd0a74078fee56b1ca35552f8ba80415239cf8f2b4c4ec5751851318d44a1f8d87d665d6c1c1dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918459, "uuid": "f1fd30ad-95e9-4423-aed0-a98b35557ec8", "value": "T164B55C6F6261D93DD11DD53AC062CE21983B7D750F33C9DB12E43A7889B68D00F3A6A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918459, "uuid": "2d57da48-9252-4bdd-ae4f-16c3eb1b256f", "value": "89ec9933fef67f89f7c4574b120b3f1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918459, "uuid": "eb36b0a2-1832-45f5-96d2-a9d45cbdffce", "value": "24576:fuQlSVvDAqpEZYE4arAPoxaH5IjPAgIg8wqJ6/Za3OtJtnZK:GQYOsEZdrAPokZIjQg8T8U3O3tnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686918459, "uuid": "58b1a346-1aec-44a2-995d-55a7c086ea82", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686918459, "uuid": "90db6579-350d-4727-9a1e-8976a4f6cb16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686918459, "uuid": "4c5c74b0-cc27-4bce-8fc9-002bdbcc3475", "value": "\u6587\u4e66\u8bc1\u636e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703216e1-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686914274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914274, "uuid": "5ebf2a61-bbcf-4369-b9ba-793fde5bcb1c", "comment": "Malware payload (GuLoader)", "value": "e5daf6477340857b1d2d04411d7c0377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914274, "uuid": "8ceab46b-395a-4917-94c1-b59be4d9d60b", "comment": "Malware payload (GuLoader)", "value": "99aa0a112de10ceb2072e32e189befed18db5ce294787bf9b2dbe0ef643ba62c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914274, "uuid": "1150ea7f-c906-4332-9909-3bba2141a0c8", "comment": "Malware payload (GuLoader)", "value": "064d70629cce898ac26eca755c1f24573d1e6362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914274, "uuid": "f19e7b4e-b64d-4b72-bae8-8b57a5137317", "comment": "Malware payload (GuLoader)", "value": "0b323e36c6a686cf8ccd62ff43f9e3bf8bcbb07fec81cad8cad3da185d5cf063e551e7635c6da6a22e3c17e3a1ae8385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914274, "uuid": "041d4c69-a82f-4571-8d22-8224ef2218a6", "value": "T1CEF5330BFA24BB97E69981B2A9BDCFF0B755E04015269A5B13FCCEFD391849C235C019", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914274, "uuid": "8e21af71-775d-4923-bff9-5541f59a4e31", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914274, "uuid": "0de3a5fe-103f-43a0-bfbb-f380cfc34bee", "value": "98304:IZxnMDp/mWgv8eLZtem6zaPtrnUQ+Ls6pVTEh6XnaVn/tW5X:IZZMD3gvDltebalrUeOokXajWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914274, "uuid": "df461c18-601f-4a6e-9ff7-743b4415c345", "value": 3596692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914274, "uuid": "658e1676-1981-45c0-bf9a-909ca02bcb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914274, "uuid": "2f740d6b-47d0-4d15-b0ef-3d66c899193f", "value": "e5daf6477340857b1d2d04411d7c0377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb21dc9-0c71-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1686939125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686939125, "uuid": "ad14482b-0c4d-47bb-912a-d9932245600c", "comment": "Malware payload (Gh0stRAT)", "value": "3f743d2ce93ef417edc31a9d20597fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686939125, "uuid": "733ea1f3-7cc1-4aff-9ee4-981b2d1c6e7e", "comment": "Malware payload (Gh0stRAT)", "value": "9a45a0f83440736ccd68482a7075c719c97369e839a7a62f7b94b55f8f536766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686939125, "uuid": "47eee80c-0d1b-47ed-a9c7-f37aeb78f6cb", "comment": "Malware payload (Gh0stRAT)", "value": "e43d004cbe3a63a94b81b1f6e9e2029d305dbd9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686939125, "uuid": "77d8305a-4532-4f89-9df8-e54099de2177", "comment": "Malware payload (Gh0stRAT)", "value": "e9fe319f7eb8e6cb0f5a9d0626f83519045e00a7570841e17a50952550b224c244562987eca8d265bb227140ab7b79ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686939125, "uuid": "bc42d3e6-42e6-425f-800a-42550e4ce8ee", "value": "T1A6959E65BBE1C0B2C3733630464A837A6679EE704779428356D52F3B3AB41D2953C3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686939125, "uuid": "9a2c6cdf-1964-422a-a3b0-baf800696f8a", "value": "d9039447673afc5ee6b8f75ad653a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686939125, "uuid": "693dda33-91fd-49d9-9c1c-3ded5103f3eb", "value": "49152:n73tU4K8OMHciL2RaPpbEuklRNKxjdkcprxdjwBhJ+cKXaq0ESNdVqUurDBL:i4K8OMHc7RaPpxklRNKxjdkcprPjw7Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686939125, "uuid": "9c1a9a76-5ff3-4402-8cd1-0e49ea3650b3", "value": 1882624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686939125, "uuid": "9699ea42-956d-4fe7-9356-dec11aea10f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686939125, "uuid": "2b4e209a-217a-4d1b-b464-235c9c95fe9b", "value": "shinpei_Sawa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f8f8f0-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897613, "uuid": "cfbd4998-548f-45c3-9aad-73d5d86f961c", "comment": "Malware payload (Mirai)", "value": "f1753cb3ca9799f7470bb2592a632346", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897613, "uuid": "176a45f4-9811-4602-8f0a-992a58a4e4fd", "comment": "Malware payload (Mirai)", "value": "9a842f71a1fb28e21ee2fa445e7fd67b3e9d356b68abd0657d4f8f5307b92c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897613, "uuid": "ae25286a-f79e-4700-a646-ff6df8e6d24e", "comment": "Malware payload (Mirai)", "value": "7a27b87e33b2e0dba5a71fcd4c5599aeee27ca6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897613, "uuid": "a9534254-df87-4ba2-a201-9134291614b5", "comment": "Malware payload (Mirai)", "value": "0789e414d04e2f247e20e59affde5dd86f18105c55c529e3628a9f6ec7e998ea0569c4ab230e970691d5d6f5aee308f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897613, "uuid": "806cd4eb-2281-42ec-ae8e-a6cb4fb9aaa7", "value": "T18DC2E060E182EB40DFFF5A346A54D1D377F11B6F6AE3D9917085A3C3664A226200BDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897613, "uuid": "cb532da4-4ccf-4208-a713-2179f74ad281", "value": "768:SVdafO76jpmNJ2Lz7qW9sgPFvT7iGZThB4uVcqgw09C:2am+Akn7qW9sgPR7RZT34u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897613, "uuid": "334af954-2ce3-46c8-8bb0-d0bbda88087c", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897613, "uuid": "5a97c1ba-285f-43d0-aabb-afa91a1cc361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897613, "uuid": "f8149ebb-ff1e-48fa-8db4-ee231e022ceb", "value": "f1753cb3ca9799f7470bb2592a632346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fefcac-0c30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686911498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911498, "uuid": "dc50b550-fb20-4bb9-a3ff-08161c447468", "comment": "Malware payload (RedLineStealer)", "value": "217ba190f5ed42238e9b1c05f2eaf386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911498, "uuid": "9230fbe6-0898-42ec-8e13-53e0d80d2bbe", "comment": "Malware payload (RedLineStealer)", "value": "9a86c98d91a1795bdd8abba614f47a7f5ccad05370231a74be952b12f3cca170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911498, "uuid": "e21531f4-6ab7-4799-be46-a8174afadfbc", "comment": "Malware payload (RedLineStealer)", "value": "6959f1f880603094edee516e977255aeb2873989", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911498, "uuid": "305f1999-fde7-43fc-b78b-c4041e275d57", "comment": "Malware payload (RedLineStealer)", "value": "85998c45ee24d962d299757c605968c63c520726ccf0f53ae97f16f21e4677039317c2ee22dc6285c6f8c2a39778cabc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911498, "uuid": "aadee141-dec3-46fe-b4ba-c697210c2e9e", "value": "T1BA65D0CA3B513620E1FE3639C2B7448497B26CA71660E7097AAC44871F71A96CC3DF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911498, "uuid": "285f6a69-12f0-4ff1-b022-5ef12f0c9b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911498, "uuid": "ad71d1cf-9ac5-4b7c-baa7-42af1d1c55ef", "value": "24576:8pdfmao+1agufMj+JiVpHM2q4r+PgemaiPuCOHXVA7lxNG6cSVY8b4bTj6:8prJ1agsM9NM2q4r+PprCOFA70asT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911498, "uuid": "98100f50-d5a0-4261-896d-0672124c1d94", "value": 1420928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911498, "uuid": "7f7f2a31-9f37-4266-ac47-bbb6cdf4dc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911498, "uuid": "e3374e5f-2100-4094-9727-87948fdd9af5", "value": "217ba190f5ed42238e9b1c05f2eaf386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74477e68-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686914280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914280, "uuid": "602a45ce-2e82-4f6e-8a02-7b21f9d5ef25", "comment": "Malware payload (RedLineStealer)", "value": "bc0221334841bb6ccd5fa8e201f44420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914280, "uuid": "d770c31d-139a-4ca6-90a9-9b6afb34d96a", "comment": "Malware payload (RedLineStealer)", "value": "9b25db97a31cd678b68c6cde52c00956c162a8904691baeed44d8cb90ec1485f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914280, "uuid": "38ed86a9-278e-46c7-a1b2-baf7a627f30a", "comment": "Malware payload (RedLineStealer)", "value": "445d5beaafdf7ecd9cb530ff86eeb88ed450a84a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914280, "uuid": "0a0f05cb-9a1c-4ce1-9596-17cf91241b93", "comment": "Malware payload (RedLineStealer)", "value": "6cc75d625fcf702af0c35341d42f2c4331491688d25954d39d5fe7f3eff031936fb2f3a4b3338e8a371151b88ed5edeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914280, "uuid": "f5e719c5-65fc-40e0-9a08-28c6af70e1dd", "value": "T186C41213E7EA9036DDB927B0B4F303930E35BDA14EB943166786654E2CB31C0A57673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914280, "uuid": "5d214ed9-6f12-4758-b5c0-ec61aea4e7ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914280, "uuid": "47767e70-07cb-4034-993d-22b980bea131", "value": "12288:fMrcy90PE1E41h1cx/nSriJy6w+YdT7/W+tBeqXy4OCb:jyT1E411igLlhhOCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914280, "uuid": "7b0505c7-a13a-4558-984c-a8e01d79ae98", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914280, "uuid": "4dd02568-16b7-4647-a3f7-00fb01585e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914280, "uuid": "6876f1bd-4e9e-4f11-9eb4-f07425168b93", "value": "bc0221334841bb6ccd5fa8e201f44420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc78ba24-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900282, "uuid": "161e7ceb-28d0-40a9-8f49-a26908826720", "comment": "Malware payload (Mirai)", "value": "5b1cc97415be26ed51d6704c2f44961d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900282, "uuid": "a88f2cbd-c3dd-445e-93a9-4b34528b655d", "comment": "Malware payload (Mirai)", "value": "9bfdda738fe57b921839bee50632723742f33b1a7b6d9a9f2e060e098bf90a4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900282, "uuid": "465a76b4-213f-469a-a1a8-b178e3e2c060", "comment": "Malware payload (Mirai)", "value": "80125b3b53fd87114578bcc142dda59cba66a4c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900282, "uuid": "caae6e22-4ac0-4214-b5c7-731dc9321d70", "comment": "Malware payload (Mirai)", "value": "96e31ebcf041bb5ae178ca46fcf686d2e8ad8428d83e5f86645a7ea6e835b4471457ea322eb9fb7c54316d17ad2b0162", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900282, "uuid": "aae95297-3948-46c9-b331-f0c6964eb109", "value": "T1AAE2E034F7A7F9EECDA41930E068058CE566F6BCE859355799B0D67C0880C9393E4A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900282, "uuid": "b45963ac-6dce-42c3-b2bc-bbc0dd6c6158", "value": "768:is0K/VSMMCUdST5LN2Svi1NJqU109U9mI0QkU9q3UELGP:is0KYFki8UN9mIq9LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900282, "uuid": "ebb6b56f-769a-4f1e-9d44-1a7c1e657f83", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900282, "uuid": "b6a5a683-2507-4f1f-8d49-3d5c6f905fc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900282, "uuid": "f0a37d01-22c5-4f2d-a15b-a930486076ad", "value": "5b1cc97415be26ed51d6704c2f44961d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615ad073-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937012, "uuid": "79273d58-a7af-4ec9-a5a9-d6cb5956f70c", "comment": "Malware payload (Mirai)", "value": "309f85141a8914aab6248824531c6d19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937012, "uuid": "8c7e54d5-8327-4a1d-9bb3-9400118d597a", "comment": "Malware payload (Mirai)", "value": "9e166d9a9f222791051b182ca3234af709bfd269b5ee96ddf2300e4583ad79b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937012, "uuid": "5535f232-927e-45f4-9162-acdcf710d756", "comment": "Malware payload (Mirai)", "value": "c4e9663c3e7e036e4d7ddc88024d19767f469709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937012, "uuid": "fca8fad6-13d4-4c28-8e55-070717ad17f4", "comment": "Malware payload (Mirai)", "value": "3e7acdf84995ecbf2c24db5fa63f927a216e50545c2ffc81796c2035836109965ea6bb7b449cfcc6e70d86eaf8665406", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937012, "uuid": "2812c9df-3207-43f4-a894-42ec6974e9c2", "value": "T18FD2E02CD64D7D45DA6E3DB951CE5AB5398CB0C0A35DF6CE17228448B617A8BFC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937012, "uuid": "dc156a16-c073-4c25-ad54-71f849d742d1", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNPUcJbKWUT:DbDs06t4BEub4sU/MbUPUc+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937012, "uuid": "a0e882dd-6686-47c2-a14a-789428097b3f", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937012, "uuid": "d491b445-7d35-4004-a84b-554c728af4d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937012, "uuid": "c93ebb49-d806-41bc-b6c1-280be6c87fbe", "value": "309f85141a8914aab6248824531c6d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3330e5f-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897609, "uuid": "6ac5f029-991f-4865-968d-7711818940b1", "comment": "Malware payload (Mirai)", "value": "2b3e8ad64b08729c805f8dd374a638f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897609, "uuid": "463f3bc3-63b9-4ed5-a574-dea5a4931e67", "comment": "Malware payload (Mirai)", "value": "9ea19e18c597a52915a3d6cd6fca775e2824cf625628a2fa89a5d322abd5ead2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897609, "uuid": "18e46eec-98d2-4eff-959b-be795ae1370e", "comment": "Malware payload (Mirai)", "value": "3dc3b59ecb0fec89110515424815cddc1771f071", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897609, "uuid": "67eddb0f-c5cd-4b8f-a388-d3c6855fd9d4", "comment": "Malware payload (Mirai)", "value": "1a7a104c74ca4158572db79704a7823c11accdb5588c6033845368777cf70419c32fb4cc09330551c851d519681666cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897609, "uuid": "5d4d34dc-e317-46e9-896e-c5c485002d8e", "value": "T13413F1D8C7AB451FCE5F22BB09E94F81B3439C2A41FEC8CDC6924D58242E5D11596FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897609, "uuid": "e2abe102-818a-4db2-8cec-2e9fa9dadf40", "value": "768:EbI6ufHPq4UMa1jTuZ8nTkDIX99MFXjqQ11ZcY/95JY520eBQmazFhvO7XT4M55:SufHXUSsUbo8XY/eBHa5hm0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897609, "uuid": "b96237e1-890f-4719-9fd7-361c87d8ce89", "value": 43600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897609, "uuid": "114ce7c8-bbae-491c-b810-9fec795ba1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897609, "uuid": "b12fad81-99eb-4bbd-aff7-156c708c132a", "value": "2b3e8ad64b08729c805f8dd374a638f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc401af-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686894731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894731, "uuid": "8007f082-db71-47b7-aa9a-11b22b20e1b0", "comment": "Malware payload (AgentTesla)", "value": "d3f1270b933fbf6852e25dc5048177d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894731, "uuid": "ebb8293c-fab7-4188-a254-d3cdcd97104b", "comment": "Malware payload (AgentTesla)", "value": "9ee3209766659d669be5ec10a720cd0fb1576353096e9728ce8b1f25fbea0ebf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894731, "uuid": "737cdb35-ba66-4d80-a664-43f314447a95", "comment": "Malware payload (AgentTesla)", "value": "43f85f44f6b997e7cff3309b70a23f5c2e34077c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894731, "uuid": "0d2f9c73-9fd9-40a9-ad67-b03c11dba5eb", "comment": "Malware payload (AgentTesla)", "value": "924360a4cef4c1fa6432f84aed9ff580c50c75243ec95f60b865f37c5ee05db74d2402259726beb2e63c91540e1d76e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894731, "uuid": "aae007b7-5d08-42be-9468-7b24c389791b", "value": "T1AA7412002BD089E7E6F15A3856B16FBB0AF39C1358A1DB0753106D9D3E265A3CE3F651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894731, "uuid": "1dfe1581-fa30-4375-8e6f-9a2f481ede0d", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894731, "uuid": "3a413cc6-2f60-4baf-a102-5272ee67c75f", "value": "6144:zT4Dt2ehA03xCpL94a32Lt8Tu9Ny3UO03YTDHpHnfrb5pwURPmpNrWtHBtm:zTgAyC/4y2LH6eYPJHnTbrThkZkHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894731, "uuid": "f3f00a19-9413-42fc-b59d-72ee62f1ff8d", "value": 359224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894731, "uuid": "06139006-fbfe-4211-9024-1c601981c205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894731, "uuid": "4853fd0b-2bab-4476-80f0-5b0be159d75d", "value": "E2000552189 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d810279-0c36-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686913813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913813, "uuid": "df0f81a9-c8ad-4e9f-8147-d9adb58ce400", "comment": "Malware payload (RedLineStealer)", "value": "516c5c71ba133b1a5df81ba8651682db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913813, "uuid": "cf04a7bc-10f9-40b0-82be-3f1ba50e0fe9", "comment": "Malware payload (RedLineStealer)", "value": "9ee8509ad40f9f783fef686af65eb0f92a65d7ef0a58593a2a40cf9e8c373f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913813, "uuid": "0f023e12-5c87-4cf0-84e8-35e898f5f6b6", "comment": "Malware payload (RedLineStealer)", "value": "65c9ef92c02b84929bc7b3c0a8022ad9215d9eb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913813, "uuid": "2b565ef7-52aa-4399-a9c0-4a2b6ec7264b", "comment": "Malware payload (RedLineStealer)", "value": "7a8659e791fa161430dc6f8f474c62ed5002b2b7c3855c138d6fab41a199e77e94b53de65a6cd90a8f0de97d40b3b659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913813, "uuid": "212a00a4-31dd-4f04-aeec-fe1a03c1e959", "value": "T1FB744C96EE93621DED127E713C7A9DC6346D6461DD48E2B2B3181F0AD6831C33E7813A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913813, "uuid": "a24b15bd-74ec-448f-85ec-74015ef6e191", "value": "72acaf8dcee1b47852a7b85487e3884f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913813, "uuid": "c7638346-8e36-4a4e-bd32-c7ae5353151a", "value": "3072:D6i8u2ibdnM5JK2DxRRyLBbja+w1yH+27RMb7unVfv6Q1F2L6Axe:DqmOw2DqEp9Q1FQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913813, "uuid": "2d21eda5-cce2-445c-8756-f1f226013fbb", "value": 355448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913813, "uuid": "b3d9f7d0-9d5f-4c28-bd28-6f48218de45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913813, "uuid": "024c996a-7517-4e18-9272-50b1977c3080", "value": "516c5c71ba133b1a5df81ba8651682db.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1156a85a-0c27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686907242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907242, "uuid": "f0607018-6bcb-4fbd-8150-aebdf313b075", "comment": "Malware payload (STRRAT)", "value": "92e2cdc3573358b1c094fdc18a4e96d3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907242, "uuid": "bd87da2e-dc74-43d0-a916-bc1a103fa8ce", "comment": "Malware payload (STRRAT)", "value": "a08c27a08f892a86b05cf016579eb2e0fa15325680c6cc0138cffc5c5800eee2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907242, "uuid": "9edba4b9-c599-4b6c-8494-6e664cd7e1e5", "comment": "Malware payload (STRRAT)", "value": "545c6030a749408b70879a1dc666a26004abaeff", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907242, "uuid": "8ac87c5d-5e7d-431e-a5e4-05c459076177", "comment": "Malware payload (STRRAT)", "value": "19f2d46f7e859632635ecff537c8395829645aa5959aae36b42fd9210880f6444291e97640f43466b47f40a189f9cdba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907242, "uuid": "763b3960-9021-46af-83d4-0cbbcedf1cbc", "value": "T17F24020BBDEBE1B9D0074A32561C8233AB4C469CD117C5FF2AFC189A5975D291B42ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907242, "uuid": "42c9b2e5-35f4-40e9-b271-4cef18bba22a", "value": "6144:2Bj/URSLm8ybCSBY8GG32aLcS6ig6YTOvhPS2:2B/LmF20YJG32aAScSvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907242, "uuid": "75df7071-eb47-4dd5-a519-b17af53b272e", "value": 223797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907242, "uuid": "b6f6ab98-d349-4351-8927-2c897200cdaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907242, "uuid": "a7406e82-dbfd-4853-b15f-dce042014d5c", "value": "SOLICITUD PEDID0 MATERIAL_.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1899ade9-0c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686896517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896517, "uuid": "cf335950-2089-4e46-9e0a-5627a9e64afe", "comment": "Malware payload (AgentTesla)", "value": "3fb1d5127bfc6cfed5001da7460aafef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896517, "uuid": "9d4aaaeb-a8b0-407a-b77a-76e2a4cfc6fe", "comment": "Malware payload (AgentTesla)", "value": "a0b5de830a76e57dfcd1c6960cbe3542a18f1eb091a8968ce319da1e4b839039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896517, "uuid": "4a12f076-d34f-4631-9fb3-5e12ff27ddb2", "comment": "Malware payload (AgentTesla)", "value": "edae9ffb83a842f640588589658535afef093d3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896517, "uuid": "2594beb9-deb4-4707-9ed2-9ed375e73f0f", "comment": "Malware payload (AgentTesla)", "value": "121ba83e0f8c06c2f08bfe064ac7c67cba3738ba37d9ff641f890b0aae645a92bb65665020ce765aef7af62ba55c883d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896517, "uuid": "463f6622-68bd-4d6d-9098-31b80440910d", "value": "T1CCE433B26952288B52F9E753E2D3A7573E07F50D1AA3C991CC400AC4CF76AED622DC35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896517, "uuid": "5fc05d98-62c5-43ea-a636-586de2d309d9", "value": "12288:qd7QYabcQavlDDKl42UzuQDQe0IGYwiAb8UR/MaSrRTkefO:qd73abcQavtD841yQDJ1GBi4RWlkoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896517, "uuid": "bd1b94e3-f318-4e59-95c1-c0827f955896", "value": 718245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896517, "uuid": "5a841709-e261-4f12-88c9-e7984ff0f963", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896517, "uuid": "af9d5560-3919-47aa-a93a-3da67a16c8b0", "value": "Modis list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa25ea9-0bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686888092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888092, "uuid": "68922cfc-5a5e-4b73-bb1d-25151dfa4f9f", "comment": "Malware payload (GCleaner)", "value": "9a30016589f0e36b08a537699f90532c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888092, "uuid": "832293ca-3653-4cf4-bb7c-e3d8d51ee442", "comment": "Malware payload (GCleaner)", "value": "a1ad3c7dbd409bbe093e7be20c667ced3428cc48332d23b9347ae36905af79d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888092, "uuid": "2ac20ac4-9d42-444b-ab3d-6e7558aaf6b8", "comment": "Malware payload (GCleaner)", "value": "6c2cf0be4260ecfd41731a50688d4409852de597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888092, "uuid": "ea3700d8-3da0-406b-a733-2f7995c4df8f", "comment": "Malware payload (GCleaner)", "value": "9f84a320071674c0abcad28359be4f756632735dba08423fdc20c451742fcc68186f73f4680b59e3f4ae62b06f597e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888092, "uuid": "d9b52e90-fd16-4516-8963-c0acc0f8f785", "value": "T16DC533D7D78148F5E8525F342D394931AE3B7EB2157E20A8B94FB81A2F730E2005A56F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888092, "uuid": "6948d578-bc4a-4212-984a-0c56ac02ac56", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888092, "uuid": "8f25cd17-3c2d-427f-ae33-cf175ceb3f2f", "value": "49152:46dlGkO8yNwpCvB+XzyXVOFMzbx8DKI1ZgGbBdrDkNvpAmyt0RYV8qmnwDOZ:Xd4XwQvBMyX06zbx8DNZjbB9DMGmyh/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686888092, "uuid": "3dd74749-3fb5-4240-a101-a0741e5f89f2", "value": 2604986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686888092, "uuid": "07b29d53-6314-48f4-ab77-34782bfca7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888092, "uuid": "2c19f256-a4b7-4b66-8812-5f18a0b0111b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f4c27c-0c28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686907671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907671, "uuid": "e52d15a5-33b7-4f04-a881-7ccb02c2c883", "comment": "Malware payload (Mirai)", "value": "fd9d1ac49a37329c39aaf522aeb3e287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907671, "uuid": "d9498c9e-ab9a-496a-8c36-e283405cdd81", "comment": "Malware payload (Mirai)", "value": "a2dba3bd9a4173b24f03e73b6e6240b7019b4253729ab3aa9dd23c3f3859861c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907671, "uuid": "6216cb1e-9c3f-4384-8107-e70fa9243002", "comment": "Malware payload (Mirai)", "value": "ac2aaf5a7a7af5dedd0c316b90e6a32ea78fb552", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907671, "uuid": "e1149d42-9891-48d1-baef-74e3ac8e5528", "comment": "Malware payload (Mirai)", "value": "c6b54bc48d15ea151b5451aecdcf028736b82074e7d9ae7e41e9e4180fc9dce376e8d8a39481673b2092cf192f079fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907671, "uuid": "93e7b058-0207-4572-823a-fc601eb62a3c", "value": "T10BD2F15C7B0545E7D6BAD0F889EA4B903EF00F66F4120E066130E6CBDF880D4A2C67D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907671, "uuid": "210c188f-a588-4fd5-887d-fd166df92cc9", "value": "768:zYZm4IMcveH1vOe/9uytUgaJgGlzDpbuR1JK:Km4c2VP4xg+VJuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907671, "uuid": "77578ced-80cd-447a-bb64-3c7b3e72e094", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907671, "uuid": "53669141-8eb0-4faf-ae7f-87ffec3478e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907671, "uuid": "6d311707-1e51-4a94-89ba-ec5349223065", "value": "SecuriteInfo.com.Linux.Siggen.9999.16371.23900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1996f3-0c27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686907286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907286, "uuid": "e9be19b1-574b-4b13-ad72-04f7f345f878", "comment": "Malware payload (STRRAT)", "value": "291f150f24c698b1732279a1e7bd4be4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907286, "uuid": "861c396a-6fd5-45b6-920e-c7dc3da1aa40", "comment": "Malware payload (STRRAT)", "value": "a2e2a352b0b93c5ccf734c14ba0367af8b8c980a1ed7622208c62229888afe82", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907286, "uuid": "78b5d6a0-914e-4c8e-981e-28b07746f80b", "comment": "Malware payload (STRRAT)", "value": "bb69a861d63f556350868d4a6a3e6b224cc619db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907286, "uuid": "274c569a-f7cd-4941-9147-e64f60e105f3", "comment": "Malware payload (STRRAT)", "value": "fff63427ff9b8dcd3bb2fcffdadfadd4c3b9ab32b128503e5ccf8c5efea9423930541b455343f173c83509ac920d6599", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907286, "uuid": "52eb8330-9624-4159-8c12-b949ded9a3ae", "value": "T1CA24010DBCEBC6E8D51768B21808BA219A0D81B5D546E93B23FD05658DF4C7F1B07E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907286, "uuid": "0974a050-b0bb-4082-b79a-b5e2c5989420", "value": "6144:tdRPN78WXHNZ7OX2cg5znzn2Ma922gt4QYtQ90Y22ssw:tTVAWXH7Q45PnrcXgt1vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907286, "uuid": "2ac2e715-b521-49f4-a567-aa056345b61c", "value": 224019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907286, "uuid": "7d117663-e910-4947-8acf-aeb2ed5ef04a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907286, "uuid": "7263962f-86d6-4913-8f88-025317549709", "value": "Enquiry_06-162023.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe84bff-0c33-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686912797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912797, "uuid": "1fcab32e-016d-4892-8df4-781b74a1b491", "comment": "Malware payload (RedLineStealer)", "value": "6a66936812064b8549dd0575d5d62140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912797, "uuid": "f434fe67-6b1d-4cb0-b3b0-6291f7e2d5e9", "comment": "Malware payload (RedLineStealer)", "value": "a2f2bd6394b4d85f2d810724480df9f5d893aa298418a262b859074c4820b84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912797, "uuid": "2e5c2275-4d66-461e-88d2-021202e2a881", "comment": "Malware payload (RedLineStealer)", "value": "b4747d4ace1811b76c0d2f74d4ec673fddb4441e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686912797, "uuid": "d64be835-efbe-465a-9c33-3a352729fe67", "comment": "Malware payload (RedLineStealer)", "value": "4ac0b6ad00492247053e55b6a41b375abc31b1a943a885bc0091a57c06c0bf60852536e2135bbffbdd4cd07d03c4589e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912797, "uuid": "efb848ab-6ce9-4a92-b7b1-f39450cc3dd2", "value": "T110947C1362F5BD50EAA65B328F2FD6EC761FF211CE593729111A8B2F05B12B2C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912797, "uuid": "ae20d24a-82a5-4c3b-ae0e-6ddc94fda4b0", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912797, "uuid": "2a8a3ec6-589f-413d-8800-31dcba46a779", "value": "6144:5juqwKETmFbiDorMJhoLTbwSUqj2wxHf:Eq1Kwbi4ySU85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686912797, "uuid": "03f25c23-5202-46a7-89e2-57ad02847b0c", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686912797, "uuid": "fcbdadf6-85f7-45c4-8973-9f01b5efcfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686912797, "uuid": "43567c57-8ca2-4017-a8da-b9031c09f2db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc2907f-0c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686905461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905461, "uuid": "4743f8f1-260e-4c2f-8577-b3dccc04767b", "comment": "Malware payload (AgentTesla)", "value": "67da96b1998087e0d2d33349050c4538", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905461, "uuid": "6c2ce5af-ae38-4f46-9600-ea609adc4e1d", "comment": "Malware payload (AgentTesla)", "value": "a3d9b5c5f18ac705a5d35ce963015c7063cb14f6933788baf7dc8d584612e70d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905461, "uuid": "33728650-d84c-4155-ac87-787f626d6c78", "comment": "Malware payload (AgentTesla)", "value": "30d1b45940636249a5451ca84eab8e3b588964a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905461, "uuid": "a982a6a8-bce4-43f8-9743-14094c14e950", "comment": "Malware payload (AgentTesla)", "value": "ddd93f56fe106fa20bb342be41ff4268e4155fdcba8d49392feac2ef4a18d21f0115d694333d1b362a315c7d5f7ab194", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905461, "uuid": "153b93ef-ad5d-4c93-9178-4819dfa595d4", "value": "T1CBC423E8C47073B4A0ABEA874BA850517FC2525B971F7AD16E24713056BD681FE0B32F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905461, "uuid": "05e6d542-e6c4-4330-945e-fdce23144c7b", "value": "12288:+pfCbHzUYfL682MbZPqDMFosMicgiz9ju4MvfUzuigd6V0:lTwYu82MlyDyIBu4MvcFW6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905461, "uuid": "aa9d4a9f-9f02-4b32-adb3-d3907df5cacc", "value": 591543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905461, "uuid": "939c2d50-3ccc-4013-8264-32eb4ea87741", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905461, "uuid": "9f3a5a47-ac13-4dc5-b074-c4d76da5d45f", "value": "quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1627ba84-0c9c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686957502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957502, "uuid": "e08fe627-506e-4493-a05b-787359c48d87", "comment": "Malware payload", "value": "8896a94c7d850c68d2c373218a9f7e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957502, "uuid": "d8d2cb7f-d253-44ea-8ca1-a958488688e9", "comment": "Malware payload", "value": "a3edc02b6c1f1156d30065851f2cd8f2d0b7bbb2cc3981eec98f92a92e271ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957502, "uuid": "5cc01d74-6a8c-4add-8710-bf9cb48edff4", "comment": "Malware payload", "value": "98b6d64e79aed8d70c67503d9c7891cfd4041c69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686957502, "uuid": "3f02dfe4-46fe-4bab-af8e-46f5813c52c4", "comment": "Malware payload", "value": "ec71c7d98cd974e342d1be3512dbf2ef54c8915787176792f4f290790aed3a6e90553990badc2edb18a9e6f0ce0d5458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957502, "uuid": "24204d07-ea4d-4fe6-87f1-f784aa94d9eb", "value": "T12BC53383C7C015B0E0219675287BB716AE1B3EF7643680D25A9E3D29BF737E25C1294B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957502, "uuid": "d975dddb-784b-468f-9f08-bc4605b1f9cf", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957502, "uuid": "a6a02c74-4b12-4156-a6b3-a42bae69c0ed", "value": "49152:U6dLnIW5J4unQsucR0L6yQ9Cq3vGL7RWzMc7ArYkDNne4JQBAJCvnwDOZ:jdcWA4Qd+yCCq/S7RWj7A/DhQBKCoDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686957502, "uuid": "473a2f8b-c985-4547-883d-64474b4061d3", "value": 2603145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686957502, "uuid": "ac93908a-1c00-4dee-bf00-a89a417e38cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686957502, "uuid": "d7034216-43e1-48d5-8e89-7257996970d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa21c20e-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900332, "uuid": "38c40509-e3fb-4cb3-9473-ae9259fd1467", "comment": "Malware payload (Mirai)", "value": "21d97faeaa0dcde7a292498fbc81f3b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900332, "uuid": "bee6de2b-ea99-493e-91f6-475670b0b156", "comment": "Malware payload (Mirai)", "value": "a4380d329948cac1769a790091db8fcf5fea05042f1f04b76edbc453706f4d5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900332, "uuid": "fb63530e-72a5-4d4c-8823-8757791a958b", "comment": "Malware payload (Mirai)", "value": "7cee8dfe186d2f4eb58a191e542aef85d6a8ff9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900332, "uuid": "17e2d7a1-bb8f-4fe5-8513-4ca71d442307", "comment": "Malware payload (Mirai)", "value": "6fd936ed3e1a7ec4226a2ad26a6623ea88a19f1b99cb7939a0f1059c4249e54156d2340a858fd304f6e3db2177e86c46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900332, "uuid": "6e60ff21-f0b5-4c6f-b21d-7c8382f6f2ec", "value": "T155C2D02ED2611CC3DBBB3C785D91B081BBBB0DD92F9A9ED0956E1F50666183A1814EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900332, "uuid": "7d1ef753-1863-403e-ab25-063653584296", "value": "768:19r4m9Sy1ds6nk9ZXshvRnMM4uVcqgw09c:rrf9SenkPUvtMM4u+qgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900332, "uuid": "515eda50-d366-4558-9aa4-7b12c0286ad7", "value": 26216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900332, "uuid": "69d4a1e2-6e85-4b55-8b74-8e38036a2dcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900332, "uuid": "b0741470-a378-41a0-9a57-1a2054792a11", "value": "21d97faeaa0dcde7a292498fbc81f3b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dd2db0-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897588, "uuid": "ac1ee215-57a4-407d-bfb5-3c5572c5b08c", "comment": "Malware payload (Mirai)", "value": "77fc8e4cc8e60b6045fe3816b37462e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897588, "uuid": "581af6b0-e728-4539-9a6e-b3c2da68d665", "comment": "Malware payload (Mirai)", "value": "a4a98d2aaf3af956a2a8e75219237acfbe9fed75a1c6d0d28929930f7eb42565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897588, "uuid": "91b66e30-0f7f-42c6-a1d2-5f736f692394", "comment": "Malware payload (Mirai)", "value": "27f961df45ad3f7cb215e21c0c20e1bf98d28c30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897588, "uuid": "32aa9131-f2c9-490c-85e7-090b34e5cd31", "comment": "Malware payload (Mirai)", "value": "7531420183a836c736b9c5ff2b4ea5a06ea86ccf0ddcfa6741ca59565ef36a754d6f831f6c695adefd7e1d57a6ef7ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897588, "uuid": "cbd9019f-fd85-4911-be9b-bf9243d71aa9", "value": "T138D2E12DE3A57910D69EACB584CA06F1BD8671C9770ADB8F13B28041FA1D58ABC491BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897588, "uuid": "163071f2-c048-4252-b3ba-d09bfb99a6d1", "value": "768:j1uUtLrVDsAp6tLWYRD5dkRQEwzsO1uoyQt4JbKWU6s:jbDs06tVsRQEwzd1uoyQGeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897588, "uuid": "57aa1b4d-aa88-45a7-9688-9eb1ec16b6a8", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897588, "uuid": "7c59ddc1-7d01-4810-8db7-251e61f77a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897588, "uuid": "0823cfab-1960-4ee2-ac32-b39cc41b0dd4", "value": "77fc8e4cc8e60b6045fe3816b37462e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c178dc-0c56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686927723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686927723, "uuid": "6048aa1b-928a-44f6-9831-2ff8802b7957", "comment": "Malware payload (AgentTesla)", "value": "71c80559028536d790ebe2c725ed53b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686927723, "uuid": "0d67b1eb-babe-4e67-86d7-32cb38aa9d46", "comment": "Malware payload (AgentTesla)", "value": "a4b7fa737e9b14062927814cbbaf0eee653a6bf61bbffb7b14bb07fd07c36cf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686927723, "uuid": "72f10092-3eeb-45cf-a7c1-bc24254f829a", "comment": "Malware payload (AgentTesla)", "value": "d6d4d019602149c295175df5d1af4235f06e3d53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686927723, "uuid": "52db24e7-971b-43e7-bd9c-3802d63e9cc1", "comment": "Malware payload (AgentTesla)", "value": "31bd34356a7bd1b5edc2d43dade8c4ec93c9044de27e18a161a5acca0ab7da7f73fb429fc4c544b9fcb801683a269691", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686927723, "uuid": "7370307f-9a43-4375-a34f-b7302d886087", "value": "T13405E10A22FB8A59C4F67BFC0930517CE7FA29567C2AD24B5DA378D84C1AF124F02593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686927723, "uuid": "c438decd-6368-4f84-a121-58859620b746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686927723, "uuid": "1c6ac4c3-08d1-4660-9ef4-cb752a862058", "value": "12288:LO4haDnLMzIL2q+RTdOL8r6Po8VyQ7sO6FLh67DYhzsTmek3yXSD8/T8ykJl8epE:3OyqGUL8r6Po8yQ7b+hgTmUIHQepzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686927723, "uuid": "40d3448c-1b92-464e-bdf1-f608b01887dd", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686927723, "uuid": "88d2cce4-0e77-4a0f-ac56-036b16da3b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686927723, "uuid": "d53fd033-862a-4f44-84ec-7a79a6e70314", "value": "BL4367914237.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d225849c-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686906277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906277, "uuid": "e2babc57-c853-4ed2-adcf-e6dfa2b8b827", "comment": "Malware payload (Mirai)", "value": "a8f75c53f94bd682499ce4339bf1efd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906277, "uuid": "11d0030c-9fe8-432b-a519-e61f42d43ce7", "comment": "Malware payload (Mirai)", "value": "a53fc4053c97de59cb5219201da4c4ce59a06ec8204a66d1a444fd0f1e1768f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906277, "uuid": "f89a3b8c-ee68-484c-94cb-9b85f4ab94b1", "comment": "Malware payload (Mirai)", "value": "f7f58099de8bde0a262575349ae4fd4f54dfcc9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906277, "uuid": "83f5b5fe-e3be-4d79-893e-3d6de020b975", "comment": "Malware payload (Mirai)", "value": "88570f2ca197ca09d2df1f2aac53fd3a673256dd49f562eb6a509c36492d058859c85935712d7e1eb78f641fd90bbe08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906277, "uuid": "04d0b788-2b7b-4b25-8703-ccf4e64ab542", "value": "T16B835B9AF5018D7CF84BD67B84160D0AB530B2D41FA20F3B63A7BDA7EC321A56C16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906277, "uuid": "4727f279-a759-4f37-9741-662a38c84857", "value": "1536:TwCak38d4qjO18H/3dYN4k48zOoQ9ThZEYnjLQlvG4oTeTBnHP:9qjO18H/t44kk5hiqx4oTeTBnHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906277, "uuid": "3e8c3250-7182-42e5-b21b-f775a56e6e92", "value": 82972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906277, "uuid": "1270f89a-4a4f-499d-a3d4-acedf4ba8f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906277, "uuid": "b069339e-9e69-497e-97fd-dfbacd06ef55", "value": "a8f75c53f94bd682499ce4339bf1efd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd47a17-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900309, "uuid": "fefafeda-ad2b-46b8-b202-c2fc2b7d99ff", "comment": "Malware payload (Mirai)", "value": "536b08d24540ddd1064be8df9891e478", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900309, "uuid": "0488ca88-8200-480d-be3d-0d847ca1d219", "comment": "Malware payload (Mirai)", "value": "a54823ccbbc812e64e065cc727b866662a295636792499c7e3cb2dd31b65a1dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900309, "uuid": "f00446ab-db9b-4945-b891-d724ad9ddf9e", "comment": "Malware payload (Mirai)", "value": "cccf3b194a398f5b533948af6af01014a4882377", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900309, "uuid": "b098c48f-7740-4553-979f-0b6ac70acdd5", "comment": "Malware payload (Mirai)", "value": "0cd40e436aaecd944663f73cd407290b6411c72389dd0ab2a72d746273ad0dc1d00f26d5c1f250e29a11fe1a31aa1718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900309, "uuid": "44e097bf-e8d0-474c-914a-60feb429755b", "value": "T16F53BEB3C8192D58D65A41B4B0284E3A6B33F01452D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900309, "uuid": "15443ede-9600-430b-aff5-4d7f58966dfc", "value": "1536:4/e/aU1ODyazF8vQEHfQ8J51c/kKe1Thb6+/CQI2a5:4W/z119vQEHfB4/LeH6IVa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900309, "uuid": "428bc67f-2591-4cf8-b5d2-a6470127c8e7", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900309, "uuid": "dbedb57d-8343-4e83-a4fd-9ce72a695496", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900309, "uuid": "a4189d70-9d67-4d5d-a2b2-3833d87a3057", "value": "536b08d24540ddd1064be8df9891e478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce52f339-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900688, "uuid": "2442b4a8-b155-4c1c-9312-d58d489a8f66", "comment": "Malware payload (Mirai)", "value": "e9f6273a617a9318fe6fe2bd7c1fbde5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900688, "uuid": "469643b0-9109-4a54-87d1-2c28bc45c620", "comment": "Malware payload (Mirai)", "value": "a5c19ca71322ee089733123ddce6e1fd3534b183b04a43bf54145e2e82dcb89c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900688, "uuid": "910695a5-6ac0-48ad-aaa0-3f60603aa9d3", "comment": "Malware payload (Mirai)", "value": "5dba48d0957cd191d5ff7485dcf2f7d8d55fb580", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900688, "uuid": "3df6ea90-293e-47fd-8505-0f84077bffda", "comment": "Malware payload (Mirai)", "value": "936e2137751ce0a00cfd08e7f1106818a4011937663cac3b0018b27a5002831fb930425483c5fdd4d5ebefd53289cb43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900688, "uuid": "08664fee-0874-419f-bc2b-208abd2e07db", "value": "T1BA538D75D16DAEA8C0414AB4A9188E704F13A1C046733EFBDA95C7A68447DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900688, "uuid": "0f9bff79-8d4c-4fb0-b937-7a4b688d1fe6", "value": "1536:Taw/VdfhF1jwtkL6rQWPb5fs3Q2bS/qbCkKyCY:TJzfhjjsQuf+QmBCkKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900688, "uuid": "2348c0c5-88ad-4306-86b9-04ff85a73ed9", "value": 63492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900688, "uuid": "60677dd8-2d51-4295-80c8-09478c419440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900688, "uuid": "44d3988c-272b-48ce-be02-ee273fb5302e", "value": "e9f6273a617a9318fe6fe2bd7c1fbde5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f291a3-0c38-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686914543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914543, "uuid": "87438e39-2413-4456-b919-0780e81f32fe", "comment": "Malware payload", "value": "2cd13cacde29daf3cd240597ba137c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914543, "uuid": "f305a0a1-0b34-4179-9fae-e083181305de", "comment": "Malware payload", "value": "a5eb1fa25bcfe5c4e190eebdd05adbf355a1e192a439ee98b4208f57022d71dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914543, "uuid": "5906b1e9-70e9-46a0-b36b-7a731938ba17", "comment": "Malware payload", "value": "6721b4899d1bc274fcf781656be6db7bb7a53efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914543, "uuid": "647fa021-9dff-49ab-8c80-771736bac0e0", "comment": "Malware payload", "value": "9f0ec0e1ef45ad96d1f07e0fbc1db7fe01e3e7564cb3cf352669350bce8c99c24729fa159519ca6e4a9420559adebce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914543, "uuid": "c1d85fe5-b87c-4be4-b978-812401233dd6", "value": "T1D9336D1272BC8B67D45E53BE2921322403B6BBB26326F3546EDB68DD25333B056057B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914543, "uuid": "e5127aeb-73f2-42b6-9eb8-0737c2da57ac", "value": "768:xMvr+P0I/IVNOZedYno9lqfzN0BTMlzUU0j9lfKfcrhTVlbfU11gdzhDIFyEI+:xcV0ZcYn0qbN4ZfaKFjdzhD3EI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914543, "uuid": "cb0a181e-9bcc-4270-b57f-b2ea3eb87d0b", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914543, "uuid": "d10041d2-1495-4121-9213-dfa7854d9970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914543, "uuid": "ea9713db-b1f3-45bb-b92c-d3dcefc1c26d", "value": "rPaymentReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e96b25-0c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686901720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901720, "uuid": "5edb7efe-ac68-4a66-8fee-c042591fe4e0", "comment": "Malware payload (RemcosRAT)", "value": "6835aab43572b7c748a91c776f339ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901720, "uuid": "f8932ccd-35cc-4bc8-8112-750d42cac4ec", "comment": "Malware payload (RemcosRAT)", "value": "a73deb18c64c97f8fae15e16fc2e4e3b8952de896262176deea4148d635e11f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901720, "uuid": "021bcd52-a375-49a2-9b0c-88c6328d8c3d", "comment": "Malware payload (RemcosRAT)", "value": "df71ffe55c4f7258910bd130b797164f6fb81217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901720, "uuid": "75859fa6-4f55-487b-ac3a-68c561b3f511", "comment": "Malware payload (RemcosRAT)", "value": "484d77421140ae9627b6cbb705cd58d110ff51e898aca876891da599f46a606627d7b39a79c0ca175aeb34e9adda975d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901720, "uuid": "24c67f5c-698f-463e-8531-8d4a95dd91a1", "value": "T115B4234CFD95CA9FF4974B308C71671A6DD5DD0530D85A1F0B842EDCBA3A3639A0A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901720, "uuid": "dbaf6033-4a1b-40a5-92f5-c765e79ee9a4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901720, "uuid": "99eaa33a-b1fd-4cb5-b87b-c334fed76914", "value": "12288:FYsA/HORkw2c8Elpbb2/1LnyoXGiPx4qja53fvi99uTVXI+2Cn9n+A:FYssHORpqMV2pnBGi2qMA+4wl+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686901720, "uuid": "c7fd8267-1a6e-4a32-8049-68e9f45be184", "value": 537841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686901720, "uuid": "ef9dbd5c-88b8-4650-9f13-6731cb5e3967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901720, "uuid": "979e5db2-3b6c-4e76-93ca-4ecf8b32f338", "value": "New Order & Samples_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38319a8-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900267, "uuid": "ec280d4b-c281-4303-a4a5-604c8348a7b7", "comment": "Malware payload (Mirai)", "value": "34fc712f03a970bda9f2ebb8a5df7dd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900267, "uuid": "39d712aa-a783-4827-bc71-0cf55c7bb96f", "comment": "Malware payload (Mirai)", "value": "a99abb8c984ec278b72995e469fa6d654efd9130c180a567cdcd0b9fdba19d32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900267, "uuid": "3ec9fd7f-003f-4eb4-9a15-1655d41fdce0", "comment": "Malware payload (Mirai)", "value": "f444d49151c09b706ba0307ca39ef5070107f685", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900267, "uuid": "fb5fc3dd-fbea-47e3-a6e3-49d07065a47d", "comment": "Malware payload (Mirai)", "value": "0f5ebb725b61c4764dcde55f75d3fd68bd939aa61279bf0e1203e1d110825d5d0fdb515aca554ad87e428502a2384b7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900267, "uuid": "bd24bfe0-1f16-4f09-bbca-51ebd18c0445", "value": "T14A6312709B959400CAE0482F9D728187D38F2F1DED7B21A12A7996DCA7F3D49E349173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900267, "uuid": "be136efe-ea4d-4d7b-a626-4d0d05053840", "value": "1536:slWiS0xJbak5zTVCgaaNKCT5TXXy8s7XdljOVZysMD6Hd8lOvDpzjQXK:slHjak5zZCqNBBy88XdlhTEWlgz8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900267, "uuid": "906ceeef-4be6-4678-8938-c45f0d7577ad", "value": 67512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900267, "uuid": "00267bdb-a9d8-4f33-beb0-e0ced47a1aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900267, "uuid": "3fe3dd53-85ec-48ca-b183-43ddea7d7598", "value": "34fc712f03a970bda9f2ebb8a5df7dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde5dbed-0c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686893359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893359, "uuid": "ede22a4d-0e7f-4084-86ea-1326d37db0bb", "comment": "Malware payload (RedLineStealer)", "value": "e8f23b0ab91ec7113661b96e98a89e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893359, "uuid": "459bf1d3-34ac-49f8-824d-12369442583e", "comment": "Malware payload (RedLineStealer)", "value": "a9c45323831e9852f7cb2d0d4dde879dca33645f400587881dfe6ce8b44bcc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893359, "uuid": "5d9aa349-c5df-43b1-882f-13deefff8749", "comment": "Malware payload (RedLineStealer)", "value": "62f2a4a0231f6a95c8400d244bc525466cc769d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893359, "uuid": "e43b9e57-84d9-4315-8de5-f2838361b8c8", "comment": "Malware payload (RedLineStealer)", "value": "062318f00e60f95d30bd43b8f34e9afee21cc8c8c078254e305f9c246ac612758117b669203d6fccd565a0920d694f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893359, "uuid": "3a1d6275-18f9-4817-a7a2-d036197ea7d1", "value": "T1A1051317A7EC9033E8B517B05DF2039309367DA19C3593BF6246598A0D72295F832BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893359, "uuid": "595e703c-177d-4ba0-8ef6-06990e18174b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893359, "uuid": "e984df54-aa24-4e68-9e1c-86fff3851877", "value": "24576:9yI79sGxWHx64jyYnMdze1kY8MDEJC2W:YIps+R48zocwE42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686893359, "uuid": "107d5093-4267-486b-8236-c9748ba2dff1", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686893359, "uuid": "3a73f294-fc4d-4d71-bc8e-73686d39472c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893359, "uuid": "34dbcfb3-3ffe-4a44-b24f-e636518eb36e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561c7e08-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686913371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913371, "uuid": "a31b9f63-7845-48b1-83c0-324a79bbbc27", "comment": "Malware payload", "value": "c0671caa06e9331ddd9749485be14ff1", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913371, "uuid": "c84f4ff8-31e1-477c-a658-f7e472097636", "comment": "Malware payload", "value": "ab892df7165da82cc214e751220dcd1eeb3a8369e8b9fbde3d5c526ba44fb796", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913371, "uuid": "b874fc05-7406-485a-b5b3-52419ee8eb9b", "comment": "Malware payload", "value": "e56ddb74198ffb17434df07065b4c5ca6b9637d2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913371, "uuid": "58c10da7-2425-4733-8cb3-5dcd95e598d7", "comment": "Malware payload", "value": "4ed796f99b163e6e25e42a0e0daf0c11bf2d7eeaefccf4e7c89b51a1421e732516940f5c7753e97e22f0715fcae560d8", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913371, "uuid": "eac55fb8-d78a-48bc-8599-64f336aa0772", "value": "T1BE453A14A7EC4362E6AC57BD4831211013B5BB777333E35A3E8E91D81B773908A55BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913371, "uuid": "a12c153a-19af-4631-a090-d93242598878", "value": "768:Fjv/IVNsQuk2CoAzzwQ5lECwZikq0ILLLlCB9d8I:FjYVqQupAz95CCwIktiMBD8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913371, "uuid": "bbcb4b3f-2413-4d34-b2dd-51083bebd23b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913371, "uuid": "d25fb6bc-cff5-422a-88a7-209b3087eda6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913371, "uuid": "811d5c18-2083-4450-9892-28f5456ba353", "value": "nREQUEST FOR QUOTE_PDF.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1c4aad-0c3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686916518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916518, "uuid": "bd312464-7231-4f72-addb-fa00fa37d9a1", "comment": "Malware payload (njrat)", "value": "c3296e49c6282bc387b8203693dbcef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916518, "uuid": "66778395-aa82-4521-8278-a530a5e36088", "comment": "Malware payload (njrat)", "value": "ac403a6bca38415a950791fa758500d31372bba82e2ff4d849c4b750228926b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916518, "uuid": "3c97c6b4-ad5a-40cc-9d39-3c799514c7d0", "comment": "Malware payload (njrat)", "value": "83cdfa7eb2b040edb1651343a8566c1e3284fe8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916518, "uuid": "6441c86b-562e-42b6-a282-a080ac7fe6a1", "comment": "Malware payload (njrat)", "value": "de592a7a7e0ef2e40e14727b202210d4cde0258d178ea1a3e138be9fa8304e3e66991bfb1fefef8f61f3903aa286026b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916518, "uuid": "46319cba-0696-4c82-b67c-6d70f39c81d6", "value": "T14B13D78CB684E174D5FF8BF1B4A2B2890B71A017A906D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916518, "uuid": "59fd45c9-154f-435c-aac1-572355134c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916518, "uuid": "b8f84c18-9704-4d40-8b8b-1a57ecacb449", "value": "384:d8Zycb58yCEFmVoybp5UkCoegE5MjMghozEIij+ZsNO3PlpJKkkjh/TzF7pWn7J9:d6N58yVAVlbDrC/yAgIuXQ/oOZ+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916518, "uuid": "cbef3079-c2b3-4fc5-b6d1-d704bbc84306", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916518, "uuid": "9acd3af8-ec2e-4514-ae1a-d6b13e14c8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916518, "uuid": "c13bbe3e-5bbe-4697-b669-2377bed1fb97", "value": "c3296e49c6282bc387b8203693dbcef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab7bf70-0be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686878589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878589, "uuid": "23783454-caa0-4c6e-b92f-76f2f0def1f0", "comment": "Malware payload (Rhadamanthys)", "value": "6c7eb9815cd703da377669b0ce8b296e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878589, "uuid": "cf0b23ed-c308-44ee-87de-f8bac4efe772", "comment": "Malware payload (Rhadamanthys)", "value": "ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878589, "uuid": "a959691a-b4ac-4f0c-ae9d-2ff3cd9016b6", "comment": "Malware payload (Rhadamanthys)", "value": "346355d5e82b5fc0d98e7473b669e38a60d21650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878589, "uuid": "1c1d24e7-d12e-49cc-92f1-9ebc6f0e5736", "comment": "Malware payload (Rhadamanthys)", "value": "cf09e4c0e6a57ba68942a0c387cb57027d3a3d68455383eab936761b54182da681278fd3372b1e24e52afd23cf90e0ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878589, "uuid": "f2752848-e8a5-43c4-b9c0-c72e3b72cc15", "value": "T16BA4F012EEF1FC72D5569A728C2DC594BB1DBDA04F14667B221C7A2F19B01A0C63337A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878589, "uuid": "50bba8df-0bca-4476-8973-4b95b97e8c72", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878589, "uuid": "96f3c658-8d4f-46b7-b324-6f5987ee2ece", "value": "6144:96k5WC6JSxgZCHH+tIvZ73uPoZWqw3ebxI/h66swJDRUmiMUmLfkUoH:96uWCisH+tIJ2oBwMS/5JDaWUmL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686878589, "uuid": "1416df87-e8fe-4631-845b-3f9de02ba92d", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686878589, "uuid": "c50187d1-dfe0-407b-9fa4-f80dc3c4226c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878589, "uuid": "220132f6-b41d-4294-8870-5b27baae0e08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c903fb-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900247, "uuid": "b6458f7e-b1a4-4dbb-8182-42c49b7dbb4f", "comment": "Malware payload (Mirai)", "value": "6ae8b469aa94c4379634ddda8561fc3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900247, "uuid": "7fe01b2e-17e6-48ad-9298-5c2b08560f6b", "comment": "Malware payload (Mirai)", "value": "ae758bcc9851649ba764024e68772fc3e54558e917ada33ae8f25bfd44e52180", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900247, "uuid": "ab122fcb-0a5c-4b7e-9e33-b241440e1aca", "comment": "Malware payload (Mirai)", "value": "e222e10c8a03dbfca08537b89c7dc09cd2a25ca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900247, "uuid": "de863267-1de6-43d7-a3e8-8a1fe4f5e576", "comment": "Malware payload (Mirai)", "value": "413048224c4b0bd0c81bf9dd593f3e4eea62ba17b4cd6745fd542fbef9dd421b05a2b7e11b8a9f573659b9d1e4dbb8cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900247, "uuid": "147f29f7-bed4-4253-9db9-6df35e50c804", "value": "T1D6A33931BA362E27C1C2A13B11F74721B2F153C925A8C62E7EB10E9EFF255402557AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900247, "uuid": "d031fd3e-1bbe-436f-9b3b-a060b60437c0", "value": "1536:qA+eQuPfwDQ1wD9H4PHgX0LToz8auQU39W9L+HRlM5ggtIpK0wbZn2T:nvScKcoAauQCQ4HRl8gD9wbZn2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900247, "uuid": "f2b6f09b-b630-4290-ba27-fd610d4aeb0f", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900247, "uuid": "0c123d8f-3f5b-4fa1-bbbf-ed1b6e83b456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900247, "uuid": "fed1df7d-1a00-459b-9f2f-dfb45c4e55cc", "value": "6ae8b469aa94c4379634ddda8561fc3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3df5788-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686914360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914360, "uuid": "ac865125-0654-404c-a5d4-7e8f1206a213", "comment": "Malware payload (Loki)", "value": "e77c90e8ff96196b410f6c0868307f6f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914360, "uuid": "15ff6672-9490-421c-8f36-d007954f5caa", "comment": "Malware payload (Loki)", "value": "b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914360, "uuid": "54485e08-bda4-4755-81b2-feed7c7043b4", "comment": "Malware payload (Loki)", "value": "5e60718c4927110e4adaa80bf2f20159a4004c83", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914360, "uuid": "2c73896d-c7b9-4978-abfd-4efa5a48c3b6", "comment": "Malware payload (Loki)", "value": "2e61b1db85d72f33f3ba68e51bb5f33528a11d306e464e97f353f92b5a3d0bce730257f7002e13797c08255855cc741c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914360, "uuid": "5a9b2136-4d79-4d96-a692-14d86c6f7b54", "value": "T147F4020022D9CB2AC57F07F6854026308776A367F577D7260DC3B4FA1E62BD2519EA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914360, "uuid": "c7f55690-71f0-4ffc-9127-7c8756e839ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914360, "uuid": "76a8ba2a-33af-4883-a89e-cc285cf40af9", "value": "12288:3Nlta2iNx5LbzIu9+r9CKOp5FevqMiikyPfXKvmuwu2QJnDIAOvJTYR2:da1j5LA9WpaqMiiRzNu2QJUzvJTe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914360, "uuid": "f8291358-0587-4e63-868e-a2d7e95538ae", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914360, "uuid": "c740a371-ab6d-484a-8894-0206e4f387c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914360, "uuid": "2534d5d7-3335-48ea-a352-22821325e9fb", "value": "DHL Expres Shipment documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddacf6c-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903049, "uuid": "91dcadd2-97d2-4dda-8447-638ec7988333", "comment": "Malware payload (Mirai)", "value": "004c482e5409813eec8761a99507a776", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903049, "uuid": "6a18249a-a26d-4f7d-afc0-d4cbc034d44b", "comment": "Malware payload (Mirai)", "value": "b18851b3a28a233283c6d23538c3eedc234eec0a2efa0f5643b04577112c8341", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903049, "uuid": "7f340627-c087-4a21-beda-70693a4e9fd8", "comment": "Malware payload (Mirai)", "value": "9a29f99d78944f8ffa9a28baad5d1f990a58b3fc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903049, "uuid": "31ce37f6-23da-44b0-8e4b-0f861300f022", "comment": "Malware payload (Mirai)", "value": "9d94b6e5514a1dfac2093d59fc3267275601120869337c4f260513828570e19ed055236743e1c10ba228b6c1d629a495", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903049, "uuid": "b5471152-cc5a-47e6-b2e1-94f59ddded05", "value": "T11DB33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903049, "uuid": "179de906-5f27-48fa-b5e3-26c6b3110403", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAk+TRCm7FnVqfJXFWbNb:T9a2aLqkrMrsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903049, "uuid": "7873e61a-2b2e-4577-921b-8d904251dc77", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903049, "uuid": "45c22961-288b-4dcf-8d80-04d29e5b856c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903049, "uuid": "e9e1ccbe-d810-48c5-a085-1d741c3985bf", "value": "004c482e5409813eec8761a99507a776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b976f0-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900304, "uuid": "9a1ccf58-f189-40a5-99ba-82da25011a4e", "comment": "Malware payload (Mirai)", "value": "088713e0cd197e78454b4885948120b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900304, "uuid": "68221fb9-438a-423d-ba16-daffb34d05b8", "comment": "Malware payload (Mirai)", "value": "b1d93aa3301e3c5894df2bb450fd06fec6d5052906f80460168471d28b6fe95a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900304, "uuid": "db559b48-6d8a-4184-8fb7-dc4fdfb0a000", "comment": "Malware payload (Mirai)", "value": "43b42757e80fa3d3f7c8314083383e910a09eea2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900304, "uuid": "2e884806-eb43-4251-8374-ef4fa2317f31", "comment": "Malware payload (Mirai)", "value": "25520ad757f566e95ad0e0a8605e29bb9f582ac05aefb585d2556a3a51414c3396aec1afb9518cd58548ce3f6a3a626a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900304, "uuid": "46e4ef62-a29b-48a4-8adf-8af1c258c22d", "value": "T1D8B2C0CD61943084CA8D7C7C2B8D4A674F6CA190BAEDCB16E350CD94B3BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900304, "uuid": "ca6d0b0f-a34e-483f-bea2-c59d26020998", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpZaZqSWv4:4QlS07FUXqIYSXQKquQqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900304, "uuid": "58a9fa7f-0ece-4e54-93a5-d6424f6aa49d", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900304, "uuid": "fad4ccf2-8110-4e43-8f0a-7710cbe6420c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900304, "uuid": "4f9ca123-425f-48c4-adb4-fa66b4c91d1e", "value": "088713e0cd197e78454b4885948120b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4498b9-0c3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686916814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916814, "uuid": "005e331b-6dd4-4005-8117-bfc0481b0076", "comment": "Malware payload (RedLineStealer)", "value": "71feef2d7c3a5b64d022f29b9e76799d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916814, "uuid": "38911379-316f-4125-8d11-73c005cf3f10", "comment": "Malware payload (RedLineStealer)", "value": "b20a55927f7fa65653a758c3962622ffdb428ef6fe03f80493b4798fa12ba1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916814, "uuid": "a0fe2055-eed1-4f19-9ded-f8c3981f77cb", "comment": "Malware payload (RedLineStealer)", "value": "4e166f8b0f35d3e654ab6a16793f17fc8f648b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916814, "uuid": "aca6983c-19d8-43eb-9ca8-536761faa51e", "comment": "Malware payload (RedLineStealer)", "value": "2a811f5db07e029649ab0355e151b9b2d8bef3a2ad37fbd02a7e892f8008c4c0830ac467937456e38716df9d62b21686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916814, "uuid": "b9911083-0598-4267-8988-2c0ae9f8c564", "value": "T11195E083BF981550D6FB263582BA0410D3739C670261E30E76DC728A0FB37A6DD6BE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916814, "uuid": "a047d883-6743-46de-8ff0-df663c3596fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916814, "uuid": "9a44ee8b-604f-41ab-8012-d4c9ac14ae76", "value": "49152:4HWOaUxJgoj1THQbUf3rVrCOFA70asTrm:8CYJgClHWUf3rFC30at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916814, "uuid": "e926f4a0-2bff-41f9-954f-0a5e0099a8fe", "value": 1885312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916814, "uuid": "177e7ccd-2e55-4768-824c-731a6a142d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916814, "uuid": "c7c01ec6-a56e-4bd9-ab8f-00d925aad0d4", "value": "71feef2d7c3a5b64d022f29b9e76799d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c59a351-0c38-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914616, "uuid": "e48d58a3-75bc-4b16-a1b1-cee351b73d94", "comment": "Malware payload (AgentTesla)", "value": "bb996d9b387101f4e91d015ef05d5d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914616, "uuid": "2f7427d5-8563-4544-9864-3876844eff1e", "comment": "Malware payload (AgentTesla)", "value": "b33364008139b4ac87da4a7bb5a5df654ce0296af0ee516fbf3c22e2c80b4207", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914616, "uuid": "afad0d28-171e-47d0-af33-0bfd7eb2e87a", "comment": "Malware payload (AgentTesla)", "value": "0a3b10fb5964b6a290e52bae073bd45c8e1b14c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914616, "uuid": "a4e9cb35-a3fe-4485-86d8-0027e5f38c21", "comment": "Malware payload (AgentTesla)", "value": "e9ab4209381caa25d178b1652ed33635588a44cf4e6a2543112fc72e93b4fba792ea7fcec96a3508d4a3cb9fae4ddc67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914616, "uuid": "87dcf761-61d7-4188-b5d3-715b18d1be3e", "value": "T165525E0AABA4C252D0EA4735547306800779FBF76F139B1FAAC960A92D1336497D37F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914616, "uuid": "fc554a10-c094-4bdf-ae10-fe49c2cfc6d2", "value": "384:iPznkx75j81pM04Rj9mH6Y7fnaY8eb+MXd:iLkk1RQirnTJXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914616, "uuid": "9cfbe9ce-588c-424b-b1e9-331773396bf0", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914616, "uuid": "9e57460a-1b60-4922-b4b7-36a03d2e9f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914616, "uuid": "a6e2f2b5-ffdd-41c2-bb4a-d7e3117a58e6", "value": "rSOLICITUDDEPRESUPUESTO_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecebcc62-0c65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686934240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934240, "uuid": "f1f2dbff-309d-4c7b-b33e-6c8ee107353e", "comment": "Malware payload (RedLineStealer)", "value": "5d38aede0d5846ef5637db30b43eca60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934240, "uuid": "625e2bfb-29d5-451c-b20a-3f72b064ab2b", "comment": "Malware payload (RedLineStealer)", "value": "b3b8813cad74d4e8e0adb95d2fee5b94f38859ea62ce2f0d4558e279101e8712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934240, "uuid": "3c342f76-46df-4e00-a0a0-a896133199ce", "comment": "Malware payload (RedLineStealer)", "value": "092fcf0a4a44777a096afefe4e10ad4f31dc4939", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934240, "uuid": "9f850e00-9a3a-4f90-ae65-a97cef07be38", "comment": "Malware payload (RedLineStealer)", "value": "68c8bcec6d15929d1620428cb128f36cf612ba22b81406c8be3451483e06af73e073aec2b7230e9a4a43b54cd28ba6b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934240, "uuid": "01d11363-a461-4ad2-a7f6-d115665622c8", "value": "T117D35A9533D98929E5FD4A74A5B1003947F0F8136512DB9FAFC0F0DF1A31BC0B6266AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934240, "uuid": "2a26f7b6-c0af-45cc-b598-2a20c9014537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934240, "uuid": "a1fb9ae7-d900-481c-8c4e-0cb9e1be5099", "value": "1536:uaPcnVHT1K/oA+Jcc+fvPIUM1ibz8VkpzYhWj9JbV7t/ZPCasYgibfbFDKsRD:bPcZZPK3PI11mEsx7BgYgafJlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686934240, "uuid": "767ca014-82e9-413d-8ad1-53496832b04d", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686934240, "uuid": "835aaf34-c7a9-4ee1-b79a-5bc519098291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934240, "uuid": "05fb18f5-d4ea-4bf1-9e28-085e98fa0011", "value": "5d38aede0d5846ef5637db30b43eca60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008e1cf5-0c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686894759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "ec3fd6c8-b444-4b3b-972a-459925085332", "comment": "Malware payload (Mirai)", "value": "8bc1e0f9896a5d9738a0ae792315295e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "1f459e03-c5a5-4d7d-a4b6-78ad61607553", "comment": "Malware payload (Mirai)", "value": "b79eb7f30437db6c4d27a5c6b0ea622f08eae4428389db6e7273634f80265ca3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "13500d37-fc23-4c09-97cc-3bed0568ef99", "comment": "Malware payload (Mirai)", "value": "7d41574baa1e29b3f2cfe30f7055ff7ff5b81200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "7077abc6-62dd-4f98-a436-c7f13167ad60", "comment": "Malware payload (Mirai)", "value": "232208cf80204ff357674ad671fa5feb9cdfeff095e24ad988a3afcdaa0e1405f79c23bc71dc86db7d118d9a446dfd0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "ecbe5bac-fd7f-445c-9f39-a25817c4e7e4", "value": "T11EE2E10AD69B1A4CF51D13B01CAFF69B58A0F70CF02D9DA1EEC5706156A93F41A341BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "351cff97-76b9-4748-8796-1224bd138722", "value": "768:AFGCwzDOmKtu3DOmZA94cwnJATviVfpciFyj9iGO5LkIEnbcuyD7UHQRju:mGCwzDmSKmq94cwJoiVfppFu7QLkIEnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894759, "uuid": "95a06c53-4ed1-4d73-a8d1-1385576eda0d", "value": 33376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894759, "uuid": "177732d0-c6f7-4978-a298-d886b87377be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "87c357da-53cc-404a-9a77-bd94686fbbec", "value": "Rakitin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ef1697-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900291, "uuid": "0135c138-f663-41fe-9543-60c10caef09c", "comment": "Malware payload (Mirai)", "value": "02b885796c143ef60f346f65572ab60c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900291, "uuid": "697d08d5-29b0-4c1d-8ae7-06a86cd57cdb", "comment": "Malware payload (Mirai)", "value": "b8598ea72ba70645cdcf406f0bf45bab359f7342f6dee54e066973120675295a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900291, "uuid": "eca49a52-f04e-448b-ac81-1460cf68e277", "comment": "Malware payload (Mirai)", "value": "2a741cf3e2d139ed01152356548264e91a8c36c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900291, "uuid": "7c8c5aab-42c7-4f90-bc6c-4f8f6e5117ba", "comment": "Malware payload (Mirai)", "value": "a7f2a6cc24eadce7b80d0992a2539a8cbef5bcbc25a554912c74892740794d31d658da719749c0021e5371ac6ff055b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900291, "uuid": "97b53f7e-ea52-4527-a3c2-82309ca00453", "value": "T1C8230271850E9EF115303C76DA99D393BAE12AB1C6673023D6290A3C6FB4B131E57F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900291, "uuid": "8edba229-56c7-41ac-b8a3-6f28ca551d46", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b369q3UELbUXfi6nVMQHI4vcGpvD:gECFd+A6YHAxvLRQZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900291, "uuid": "df04f5b5-d5b9-4c2f-bd20-030663afad29", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900291, "uuid": "4b8a9702-db96-469b-bb09-d0441b4b47a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900291, "uuid": "eef38207-fb68-4c81-8742-4d468babe552", "value": "02b885796c143ef60f346f65572ab60c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399569f7-0c8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686949830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949830, "uuid": "2f266fb5-2f2e-47bb-bb52-6db2bc43a9b0", "comment": "Malware payload", "value": "be09d1a9fbdc7fe4ad47e49a0ccf2a0e", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949830, "uuid": "e740dcc6-c194-443d-ac3a-c990c63ee83b", "comment": "Malware payload", "value": "b86193f0f5eeadf451f23596dffb4d015245311c67bc15244c2b1c81293d3679", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949830, "uuid": "e17aecfc-1b2d-4bb2-abff-582d3f3f5ce9", "comment": "Malware payload", "value": "3eea7d856de59fefd670110c2edda63c319a5a1b", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949830, "uuid": "7109807a-06c1-41fe-bb9a-8defecd049ff", "comment": "Malware payload", "value": "189ecfa413b572c53f9ae6a42f9c6906458c141daec0623dbd0ca6913659697deaf1feba29843bea97ca93df39e4abb0", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949830, "uuid": "ec6b91aa-2ca7-4c18-b8df-51cacc898974", "value": "T146F25B04BFF9CF7ACE1D99F9807CE3510320E19A6247F7929A1C49A9C6237D09167A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949830, "uuid": "ae86d854-01c7-40cf-9cb9-9db399bfb4a4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949830, "uuid": "917c4cb1-5881-4a4b-9907-50bfce198eb1", "value": "384:12ds+eOJ8FIkwQLZjqAioJYkvxQgETk/eyJCbUi34Hy0uEhGNvuA8GvLXJhH9bkn:c0ITAZjqAVKkJddcrl1t9bZnwL4du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686949830, "uuid": "63f02e89-07c9-4024-b765-d278a44465fe", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686949830, "uuid": "5a98b9c7-b410-4971-a6c3-45142f2e217c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949830, "uuid": "7b04f2ac-282f-45bb-8e15-ec10f42e20fa", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a2f024-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686913607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913607, "uuid": "5e6c3f92-4f30-4eb6-bae8-44149a559a0f", "comment": "Malware payload (AgentTesla)", "value": "3b2f6da8c6cefa7087ffac384fa8c79e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913607, "uuid": "e5a6a590-40ab-4205-ba35-31a806dd2b67", "comment": "Malware payload (AgentTesla)", "value": "b88ee9565c6fb2231db513b25f108f971d11f33828d9077114fee94e2f5b69b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913607, "uuid": "5b83eefd-2c0c-4580-9f50-8286fe8e0912", "comment": "Malware payload (AgentTesla)", "value": "eda5a94eec1795d3ef429a6555640051db112e52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913607, "uuid": "1acad730-134b-4aa3-8e24-09497dbb68f3", "comment": "Malware payload (AgentTesla)", "value": "c658465a04d86e3babfcc6e3455740e7b6ae883a09a6710484e8ac60c831a606b75ae701087c527ba48bec124f260292", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913607, "uuid": "019a4156-265b-4ede-b9c9-25692b4cdaae", "value": "T1E9C4230C545D21F6D136182BA2CF64C677B9E9073FEA5AAB3F9190798BC3F9436B2410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913607, "uuid": "63ebf1c4-4352-4e63-90dc-84c0e461e778", "value": "12288:pvmd1JbcRcwHRmY8BBGvTIIoMCcWVqNXcvNbybPhPuzxaiNfWin7:pvmd1kcwcGbNoMoVqWNObPhPMxayn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913607, "uuid": "bb0ad170-0806-4870-90c3-21be301b9553", "value": 590136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913607, "uuid": "61005df7-f926-49bb-bae2-de155f376229", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913607, "uuid": "4e36db83-cdf2-4402-8707-2dbbb5ada7be", "value": "SOA 701429859122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3e5ad6-0c6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686936253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936253, "uuid": "d7fff3fc-2b24-4393-9ebe-5af900cb4302", "comment": "Malware payload (AgentTesla)", "value": "2de6d052aa9607f10149d61832283ada", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936253, "uuid": "d1aa65ff-2745-4ccd-99ae-a747d66a7a01", "comment": "Malware payload (AgentTesla)", "value": "b92d18e28a0d9818d6b6cb017a1840a5f4786fd32287cd89e71646ebaba74866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936253, "uuid": "405e0a95-330b-499e-aa80-60642c015c3a", "comment": "Malware payload (AgentTesla)", "value": "85baf92c43e988bf98bca4aa6c02dea02e707aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936253, "uuid": "73e322f8-3028-4453-b480-fe4397591560", "comment": "Malware payload (AgentTesla)", "value": "334ade6ad62eaa1426af78f240e3bf3748bd527ceaa84db198197902d86aa79815c33485af7c174045012e15c9219aee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936253, "uuid": "7e78a094-1ff2-4b13-9fb6-99899cfb978b", "value": "T12C05124235144957D27A3BF98F21A2B433FF97CA7916E2CB2D8BB58AD8C6F451310B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936253, "uuid": "01f83a27-8673-4636-8653-19e298033493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936253, "uuid": "51521a9e-b2eb-4048-a422-aab37c1b191b", "value": "12288:fecvG73htU7/2eQ1x9aESP7XcuxsUXgGkqogj7kLfQKLcWUJJPH6gAljHQPIn:fegG1tCueiGsuxPkqog72lAWUvPHNmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686936253, "uuid": "712c722e-d9bb-4f05-8236-2c0710779949", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686936253, "uuid": "e048588f-016a-4be3-b915-276a6a9a9f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936253, "uuid": "8774af50-ec87-44d6-a431-b2a669456052", "value": "placking list & proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef39571-0c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686904635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904635, "uuid": "25d58e65-2af7-4d82-9463-0e1798805321", "comment": "Malware payload (Mirai)", "value": "585767129503b92da5063797cd950cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904635, "uuid": "43de1078-cf68-4376-abfb-f2be4690e189", "comment": "Malware payload (Mirai)", "value": "b92f57b7ce367e3cf3351fb850e5b770ada0a1cd3d6e187497d03ea7aec9039e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904635, "uuid": "0eeb6ad3-2888-4c78-b5a5-8beedf7e8bb6", "comment": "Malware payload (Mirai)", "value": "477b492286a755560222123f5e4077092be92e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686904635, "uuid": "cfc284af-3c56-41f6-a439-4cdbf40deca6", "comment": "Malware payload (Mirai)", "value": "ef0eb3a8f003f6639480c5e971cc37b5e8255a2f79ff408b17d08fe442ef10f4dd3a41fdd3884b02df4e8e453f436119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904635, "uuid": "27bebb25-0e48-4a01-926d-8e3358d24470", "value": "T1A623F1AC060FA82ED777B6FF0C1A07772F01391629CFC545A9B968AD569D250CC7CA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904635, "uuid": "1e24ff74-3dcd-4e42-a026-c68029e36d92", "value": "768:/7JJUgQuAzCJ/OGzeSGd/QAl+S3hHEdXhKgksHIZ5+6dBjLnlC:/7APBq/OGzdqJl+S3hcA4IZ5+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686904635, "uuid": "3b90fc49-90a5-413b-876d-44a9ed04733d", "value": 48056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686904635, "uuid": "24b0aa27-f193-445f-9252-c6ffd19f7de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686904635, "uuid": "b41ab681-21d8-43a0-9a88-bb84c0976fab", "value": "SecuriteInfo.com.Linux.Siggen.9999.16499.13498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6aefd5-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937062, "uuid": "f5808b00-09bc-4768-9ef2-14b703265d26", "comment": "Malware payload (Mirai)", "value": "4b177d9d763987f8cd82d34f5c6309aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937062, "uuid": "541bb68d-a1be-4132-8f6d-4eeb14e35dfc", "comment": "Malware payload (Mirai)", "value": "b9ef4f37fd48dfce7ee22797302babdb5d2a8906f7c7e2a93d87d30c1e49dcac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937062, "uuid": "90a7db3f-86b1-43d3-97ae-053518f4be08", "comment": "Malware payload (Mirai)", "value": "428ae55e9f94921fae81c6ce450ace008f35b36b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937062, "uuid": "f04936e1-50fb-4bc4-960c-ec6f667c734f", "comment": "Malware payload (Mirai)", "value": "14ffeb055a5afb5ea293f7679b7decd1c5500b1f392100450737f15f0a1b1752895e37db2e2584bcdc234ec9dafd23ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937062, "uuid": "cbc20c0b-fdd2-45b7-ad5e-81bd41d33095", "value": "T1BF539FA5C5ACAE58CB1441B8B654CD388723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937062, "uuid": "14fee0dd-c00c-43f5-bb7f-e735514d03c0", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937062, "uuid": "defb9d9e-3eb5-4095-8ea1-9e5ceafe7ab6", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937062, "uuid": "c5513b0a-c448-44bc-a4af-00fab57e9dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937062, "uuid": "5f6c8210-b154-4424-813b-e0d02172ef82", "value": "4b177d9d763987f8cd82d34f5c6309aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0c773f-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897572, "uuid": "ddf0036f-d4bd-42c9-ba39-40c708c60233", "comment": "Malware payload (Mirai)", "value": "db106675a79addad52571454f449b5fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897572, "uuid": "32a19a5e-2100-456b-9220-b7f338a45ed8", "comment": "Malware payload (Mirai)", "value": "bac621d8ca636075f0ededc2f37491ce36a5f8eb70bd2b30b9cd3fc828d063b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897572, "uuid": "3444990b-cd22-4de6-86d6-6a63c8572cdc", "comment": "Malware payload (Mirai)", "value": "57acb870935c180df0f2d0f5b5dfbc24ea5be3c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897572, "uuid": "573da502-e5fa-4efa-96a7-cd7ce3cbd1a2", "comment": "Malware payload (Mirai)", "value": "db30a4385b096a99a385efa07847736c3d0278cb8aa023228b17587800635090cae8dbfecd536acc941a400ee1b52fcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897572, "uuid": "3d686c55-ef51-4496-b8cf-f21a02c638c4", "value": "T1EA13E1A971151DB1F7207D35D7FA8359924749F8F0E434B28A010F386DC37AD17AAA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897572, "uuid": "4f8bf3bb-5f8a-45b4-8411-0082dc5fe817", "value": "768:EISz4oBjrLtDQOSKC5O30/sXKb3M4CzgKONM3703yoEMX4Sw1lDm67s3UozVt:EIITSKl9XIcFQNM37PMXojS6mzVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897572, "uuid": "263a69fb-5cd7-462d-b5d8-66ac53e709b1", "value": 42676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897572, "uuid": "452fbf78-1af5-497b-b759-b0959d1c7c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897572, "uuid": "feae63b7-113e-4cfd-8e21-fde50bbc8146", "value": "db106675a79addad52571454f449b5fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5f3d20-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900313, "uuid": "02b6ce27-6548-4839-9b79-98b8aa8e407c", "comment": "Malware payload (Mirai)", "value": "9e2f66d56b24ccc39c9bff902bb6ef8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900313, "uuid": "a46cc1c2-877c-467b-ba46-8ae147cbf46e", "comment": "Malware payload (Mirai)", "value": "bb7f5a439ae7962af5d0612e373283117041f967a8910ced1752982508c63319", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900313, "uuid": "6cee86cf-cb63-46de-9617-4af0761cf8f8", "comment": "Malware payload (Mirai)", "value": "87b2cb39939e4c0baa885638500bc756e18abbc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900313, "uuid": "b94e1963-6cc3-4f04-84c9-e2f2cdfdd4c6", "comment": "Malware payload (Mirai)", "value": "ae044cd0dc4d78acbce901dd99392a46d369e107a5795af49f16b5e6cf9748c0308c6e15de7fdb4b0a29b1bf005b4c3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900313, "uuid": "baea07a8-d32f-4b05-92ca-80ca693aa709", "value": "T164732A26B97A1F26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900313, "uuid": "ce547dc0-4153-4b07-9ff3-070920cafb8c", "value": "1536:xD/B6f6UD5hAS7mo0DCCAXpSSr6v3GTtqnNZW+:N27jqCVGv3GYb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900313, "uuid": "b564ffed-dff1-48bc-a02d-55a271ba5624", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900313, "uuid": "8f9527ee-1916-4bec-834f-82a4fb4b5e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900313, "uuid": "dce3c6ca-0c90-4203-8d18-b4ffba0c7e2d", "value": "9e2f66d56b24ccc39c9bff902bb6ef8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034aedb5-0c32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686911943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911943, "uuid": "b250dee4-1fa0-4e79-aed3-7a2c95613ecb", "comment": "Malware payload (Quakbot)", "value": "517fc5f167974a8e8b485ccfdd3673bb", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911943, "uuid": "2678c1c3-168f-4518-8347-d343cde482ce", "comment": "Malware payload (Quakbot)", "value": "bd5cddfebefeb3911c76bd13ec67f2b02cd3876786beb0b3685572ab80714fd8", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911943, "uuid": "b8ada56a-d35e-4021-b6be-98ca6707d66b", "comment": "Malware payload (Quakbot)", "value": "a4debb4d31fb500275717e2722fd291532418e24", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911943, "uuid": "26167de0-f67f-449b-bc21-a3af3f861420", "comment": "Malware payload (Quakbot)", "value": "15414600c879e52cd0eda9eab7ea9fd40e64b9ad4dab9bbf5be6659f4b9a631b35ce41aa73f3ff8811ceae1410002c34", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911943, "uuid": "487925fc-ed90-4603-aaaa-fdb5f9769cd9", "value": "T16E458D81A78354F0E496757473AEB63F4B393748831C81F3DBD42E81D9391E25ABB298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911943, "uuid": "321cd47d-dd53-4298-83c1-af9583aa2472", "value": "0c82c186a57f1cdec6d116d473f51dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911943, "uuid": "c1e14d53-8762-4a42-8344-a1c8348fc3e4", "value": "24576:KGSbIuGSom9C0k1HH1cqj06uPi2bro8nuuDYmc1WpFgiYnGn6AF:Kf8r9W01Gn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911943, "uuid": "5fef6100-70dc-4ccd-b040-ab1e17e08b99", "value": 1277666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911943, "uuid": "fc77735f-7529-4fae-bcbb-c147993b2a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911943, "uuid": "d07347e8-52d6-48c3-bd45-3fca214c32c0", "value": "99.9.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a166e1c-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686905969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905969, "uuid": "fc2ec5bc-6d5a-42b7-8a84-d7a50e7ef39c", "comment": "Malware payload (Mirai)", "value": "f2f04caedcc2796cea810cdaabd8bb03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905969, "uuid": "d75dd898-2dd2-410b-a55a-018c04e802a3", "comment": "Malware payload (Mirai)", "value": "be4ae7e5d3ca8cedd2f618348f4580cf6f76b15d5623f3be51cc95da1f2875ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905969, "uuid": "690ea211-648a-49de-9de6-4647a6da7d84", "comment": "Malware payload (Mirai)", "value": "44ce5cb40813acd37fdfc2eaac0caeeeca02791a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905969, "uuid": "547685a8-b207-4a30-894a-4ce11da255f1", "comment": "Malware payload (Mirai)", "value": "fc2f01524d66024d1830d7c0eaa5706a21221ae1a3d0d61a1b8f28b19c863a729e53c44a57b0d2b78e04a746b797eb3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905969, "uuid": "f32e6c4e-f95d-48b8-9710-eb334830be79", "value": "T11563AF76D9162D94C049817060E8CD7A3B93A5C462A32EBA16F6D2B6C803F9DF44DFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905969, "uuid": "77083c3c-0d32-4380-87c1-0cf1e5849f64", "value": "1536:8/E//8AYFayHKisUM6Sk589F+T/EmK66oxkru2POCx6rbwbZnN:8c8NxlsUKk5TTsZ6ou2POlbwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905969, "uuid": "97cd613a-bc5f-485f-8c3e-0521ee31a57f", "value": 71604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905969, "uuid": "735daa48-1e5c-4341-bd84-bde44fa96c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905969, "uuid": "0141f96d-b635-4cbd-8da0-a57dbf2370d5", "value": "f2f04caedcc2796cea810cdaabd8bb03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c59c2a2-0c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686897812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897812, "uuid": "ab180ebf-b5de-4ca4-abf1-db00f77df400", "comment": "Malware payload (AgentTesla)", "value": "1f5480681df86f297770a38c1882b0d8", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897812, "uuid": "eb31e03e-d285-4a65-bc5b-a11820da7143", "comment": "Malware payload (AgentTesla)", "value": "bfa51a7b0322bd2a8ce56647c15397c414ca84036e28b696ad7a9a6dc73ab38a", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897812, "uuid": "c85b4f78-6871-4de3-82a0-6772d4c3aa07", "comment": "Malware payload (AgentTesla)", "value": "40de1ef2604a7d450ba915e4550e73aae670ac32", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897812, "uuid": "33df91ee-8b5f-4e11-b162-42ccba1bcd43", "comment": "Malware payload (AgentTesla)", "value": "a5e8daed5680b8add523ac6ffffdab1ec6f9df0245018f8ccd031c5524d3f5582169344e164e3e16a7884529dedbbe97", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897812, "uuid": "3c5f8a12-06ef-41f7-b2ac-9c6088d7c43d", "value": "T131A423B1615BB14579EC67D32456059BCE930BEF6E0E586B56880F0E82B4163AFC383F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897812, "uuid": "c66ce3a2-15b9-421e-b8a1-0749919c8223", "value": "12288:mG+gPoLYerHIuFSrTUaIBFRdfxK37bA2YmmnsAnoyv4lCl:muQsQXzA3ssnBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897812, "uuid": "5b82b626-4ee9-4b40-9473-c4c083bdaff3", "value": 457018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897812, "uuid": "b0ae5111-6d41-4d21-8aa7-5734c8f5af53", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897812, "uuid": "9794466d-4e22-4d56-b221-ea8a710255b7", "value": "1092991(JB#082).r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee9eb5b-0c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686905708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905708, "uuid": "a880b700-10ea-45fa-846a-477753f012ed", "comment": "Malware payload (RedLineStealer)", "value": "a5526238e78f6e7e9463f06448dd210a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905708, "uuid": "92a93450-f0e9-4b9b-85ad-ae84d2b126b1", "comment": "Malware payload (RedLineStealer)", "value": "bfb9673aa05a5ffe99bf6dbe80e621e2c6d1883e132a4d6888430b5913a1d69b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905708, "uuid": "53354503-d288-4c74-b383-0c44168f754d", "comment": "Malware payload (RedLineStealer)", "value": "926e75fee8c64cbdc2c20be74eec713f2cdc2fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905708, "uuid": "01bf7c88-0305-47e4-b79f-3c15c57509ce", "comment": "Malware payload (RedLineStealer)", "value": "e90398b410d36a77b97b8133a4dd841663cd24d8555b1417960e7a1d0dfd42ef09f475b4795153d7cfc037f89e40a403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905708, "uuid": "9b684387-254e-456b-86ec-c18f30018879", "value": "T188052263A7D4A072D8F46B304CF713A32A367EA1493493AA1784DD9E2C736D5E532327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905708, "uuid": "0e3b0efe-5321-408a-b41b-cc09e4eff330", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905708, "uuid": "2a89eafd-d7de-498b-9463-1172a9429fce", "value": "24576:4yqupAOP4UhyTMY4w6hiZaG64O0F0EZul:/NivUhIMRdhId7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905708, "uuid": "08dc83db-a717-4582-bae8-52491fb17b36", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905708, "uuid": "5e8dcf34-cced-4b64-a449-152e4f30ff04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905708, "uuid": "13e01471-2ff8-49d7-b0b4-13984d3cb5c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccbf58d-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686906027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906027, "uuid": "bf6efe39-cfe1-4295-b72c-87925fc8f8f1", "comment": "Malware payload (Tofsee)", "value": "e7d1ac8308b1c958a1ac17bcda328b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906027, "uuid": "7a83ad5a-abbb-4bc8-acf0-9942f4e1dd04", "comment": "Malware payload (Tofsee)", "value": "c08f704c4a1a97a1ae5a7e86bbeaa6d103320688939b2bf06a42389c9cb840a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906027, "uuid": "2781f1d2-613c-41df-bf86-5f6945e53cb4", "comment": "Malware payload (Tofsee)", "value": "bcf93d4b9ad4042f71f7a749774e7478615a27be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906027, "uuid": "92599f77-2a17-423c-b520-082c267033d3", "comment": "Malware payload (Tofsee)", "value": "b4bbb7d54d274e674500288460208551b5d14c3410cdd38fd1c86c617f2fe653f2d9271609220b535a7ee4417ea6106a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906027, "uuid": "6b2eb87f-a0f7-47b1-a0e3-68a029bf36d6", "value": "T10D740903A2F17D50EA665B329F2FD6EC765EF250CF493769221A9B2F05B12B2C163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906027, "uuid": "d2490036-394f-4bae-9f0a-f7df801fc9b4", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906027, "uuid": "c7cfe1aa-854e-4a57-87a7-79ab5599ba5e", "value": "3072:gJoYR61vDV4hjyvVLrmb/8UoVCANoUNB1JZkBRG5VVC020fT:UR6xDahjmV+v2VVr160B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906027, "uuid": "bb1158ff-0cc7-4d0e-952f-b5e7595e1126", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906027, "uuid": "b9a6da81-561e-4596-8976-da8200763f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906027, "uuid": "1cfba7dd-81b5-45ab-9866-98a54310628f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55e7917-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900324, "uuid": "04d0f692-d322-4146-b591-432ad612ccd8", "comment": "Malware payload (Mirai)", "value": "f311ca0dd3de4f8f749a2549412976b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900324, "uuid": "67bd3361-197b-43d3-a640-b5435ba96193", "comment": "Malware payload (Mirai)", "value": "c17a37abcc78a934480d4a46bb789c87387274a53fe33856c3357e4373507c4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900324, "uuid": "61dd4343-7607-4fe1-b97f-2326d7713d03", "comment": "Malware payload (Mirai)", "value": "8e0bb96a2642b98854c6dd423603ec5695037c2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900324, "uuid": "194a431f-3928-479c-8260-875a8e807d08", "comment": "Malware payload (Mirai)", "value": "c773972c0fbb8d695d6622a9af5c1192aa811128a563f91a9cdae01a6331bf3e40b577150fe0b6fed4e6aa79163e4ac0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900324, "uuid": "39fe5b79-2d26-4cb1-8a00-de7e8f21603a", "value": "T1BA1302EACEF82CCECEFD1D3CD1F919A0EC88B5C0662E87DD874486819749D48F48A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900324, "uuid": "6825e7d4-f1b3-4316-b203-167b70942e3d", "value": "768:Fi4JekKiWbcudzL9wd2MtNrmQ58MSCcIVCvPzAokyQORDQumydWMC:U4ervRL9wxQwHQvPeSDQcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900324, "uuid": "2408b609-e135-496f-ad96-e627bbc8135c", "value": 43216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900324, "uuid": "a75682f6-daf7-4b7e-949e-a4fa246709bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900324, "uuid": "ed6bd1ed-3eb3-4cd9-b550-fdb2a8e49aeb", "value": "f311ca0dd3de4f8f749a2549412976b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8b8b6a-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897621, "uuid": "b095d77d-b33f-4c2a-90fb-a676460c347f", "comment": "Malware payload (Mirai)", "value": "260983819965b695f80d0b5d7bf30b86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897621, "uuid": "d54e455b-936b-486e-93ad-49ed45779c02", "comment": "Malware payload (Mirai)", "value": "c2aea0f056ebaf2d0dc2b207cddb602f81acadb8cd0aaee71b6eaa3f137f9a97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897621, "uuid": "b9b1f13a-f76b-40b4-8a79-e4fce3932864", "comment": "Malware payload (Mirai)", "value": "71e64aabe92aa2e17c2417bd0a64be5af1266e45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897621, "uuid": "a17bc278-9c8d-47ce-87a4-704ab42668c9", "comment": "Malware payload (Mirai)", "value": "ed6e1463fd12ec8d6cd28de679f7a497fed2a85301fd376289373949ca2f0a302c228e69a680c0fd396151c533627390", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897621, "uuid": "9631d4cd-a7f2-47cf-a752-8d6f5725fc98", "value": "T1D3535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897621, "uuid": "4eb95057-b89e-48fa-843a-19777736c769", "value": "1536:AXyRgQFTTbSX5dhLepSGYdcFuxYhON2PPB+qG76E8O:N1Gje8EVGOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897621, "uuid": "235b8e88-cf64-46fa-a920-1667df392562", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897621, "uuid": "04642e16-d739-4ae4-9b31-7dc009bbd90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897621, "uuid": "2b919f04-0460-47e4-a54e-77b2d00011dc", "value": "260983819965b695f80d0b5d7bf30b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3297fe-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900256, "uuid": "d47a6faa-9e32-4d82-ae6a-6d81c0376c0b", "comment": "Malware payload (Mirai)", "value": "f974b2202a99d20aea9a8fb83ffdffd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900256, "uuid": "7627514f-8616-47fe-b573-c23ad5b738a6", "comment": "Malware payload (Mirai)", "value": "c2b0acb598fe90fb1f6d02ca8e52b6791405cc7d5f08103ebea87522baaf4a1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900256, "uuid": "60e87c4b-81e7-4412-a3bf-701fb368adeb", "comment": "Malware payload (Mirai)", "value": "361d6f026e748da4e95ae3bc3bdd303b9fe71283", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900256, "uuid": "66f1ca78-a627-404b-b8f6-1f748398b04a", "comment": "Malware payload (Mirai)", "value": "a8a800a9a609ca050b438bf6a0de935739880232da525ef49b44b9d15c7b58b082b58506ba7b084e72269f61e9641ee1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900256, "uuid": "3d739951-5424-4fab-a90c-e2d8d94bfd05", "value": "T16D93D81D6E219FBCFBAD863447B34A219648339627E1C685D15CEA012F7034E349FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900256, "uuid": "63322528-8ab4-4f23-aaf7-79e25e935100", "value": "1536:6Jv3wP53+9DqddghwK5jna4BFpoWA+L1Uxep+peM:83e39ghL3BFpoj+L1Udpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900256, "uuid": "eb03f56e-f72b-4d8d-a10b-6d9a7ca0c468", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900256, "uuid": "fdca465c-c301-4282-b1c6-b8f813669202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900256, "uuid": "56be1b9f-2464-40ae-82fb-3d3e3ae0891b", "value": "f974b2202a99d20aea9a8fb83ffdffd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019c15fb-0c31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686911511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911511, "uuid": "dbe5bd7f-3026-4d8b-9689-08e4c269a5fe", "comment": "Malware payload (GCleaner)", "value": "c15295928e1fd2a66866ef914b7cc8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911511, "uuid": "69725484-58f9-4bdf-825b-d1a3e7a5b335", "comment": "Malware payload (GCleaner)", "value": "c3a82b7de674acf404477f5c6a746efd1dd4c90411761e5f9933ec40d07e84b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911511, "uuid": "f6845449-4132-4939-80e3-ef0b598601a1", "comment": "Malware payload (GCleaner)", "value": "3bb8a9ebadb51743d8ddea751d2ce64565cfab8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911511, "uuid": "b5a639bb-1cda-47fb-8099-e3c9425813f0", "comment": "Malware payload (GCleaner)", "value": "e22b0c7b6aeb69e35657b2118a1c637ce25bf8f6875b889b228e4bdd925f655cb1471ca08fab80255c819e7344241497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911511, "uuid": "18e4b13b-7e01-4bc9-8eb6-2fb04239305c", "value": "T199C53353AF8695F4EC194B7C3D348952CB0B3D3B18B6007879ABF44A1B761D324A762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911511, "uuid": "81a99203-f57b-4916-8d8d-b16f603a2015", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911511, "uuid": "c9ca5653-10f1-4c23-9706-0ddccf68ce91", "value": "49152:86d0q2xhfFpCB5nLJDw1ynBhp9KWmj1JfU5LopNDByUpd5nwDOZ:bd05hfPCzLJDwsGK5MRRpsDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911511, "uuid": "99c15b57-1377-4027-b786-e19ab36d8c86", "value": 2605541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911511, "uuid": "ab8d79fa-3e54-4a51-88ef-0c1b8c36009b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911511, "uuid": "6ec79b81-809c-45ae-aaba-10d5e9ddb47c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944a53c1-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897584, "uuid": "9559f289-9027-4516-9347-a8637f74e091", "comment": "Malware payload (Mirai)", "value": "e2cf7a0c412eceed9b08fc67062c8c3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897584, "uuid": "6e9d038c-3b75-4a52-a1c4-b18b2822b5fb", "comment": "Malware payload (Mirai)", "value": "c3d7a5ce2426c51b475df4eed7cea40b0669e46ae81aa5b7493ce4adc72155c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897584, "uuid": "59276c1c-d0e8-4e25-a097-396de61298e0", "comment": "Malware payload (Mirai)", "value": "12978ae1d7f22ad979d655ade1cac99a63663068", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897584, "uuid": "dcf9db9e-f837-41ea-9532-c280312ff72f", "comment": "Malware payload (Mirai)", "value": "3128a99cb90644eb07aa610670c7014607ad0ddc108efb4730a6a3d420b9efa79bb276c5b0acda1ce2510be3bc8cc6e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897584, "uuid": "aa29051c-e948-4398-a988-afe7806747b3", "value": "T1E1A35B21BA362927C1E4A17F21F38321F1F6265D25A4C61E3DB10E8EEF2465035A77B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897584, "uuid": "3d6db38a-b509-417a-96c4-d1f7312f364c", "value": "1536:scpf4Q5oXy4KoH+0yPfKWI3rgdOpQYz8AVI2iZ75QtTC5m8X:dF59zb+sdOp2AVwZVmGxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897584, "uuid": "8b6e30fb-ce1b-4a7d-8f9d-733b147d85f7", "value": 102528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897584, "uuid": "8770d253-61d0-446a-99aa-640008d7f6a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897584, "uuid": "398f644e-5073-4c70-a4ee-5eabc58aee8e", "value": "e2cf7a0c412eceed9b08fc67062c8c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9340cadd-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686914332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914332, "uuid": "58833a34-5833-46b7-a46a-a566e5f46937", "comment": "Malware payload (Loki)", "value": "0315ccfbd6c9d21d0603b4f7505ea464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914332, "uuid": "d58053da-0ce4-4dd5-8f67-460d4cd8e2b2", "comment": "Malware payload (Loki)", "value": "c41a86ef4cc333d1fa382b1aef023e72a4316dcbf7e0fd7b2670d2badfd17477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914332, "uuid": "56997874-3fa8-4420-a632-06b9779833bc", "comment": "Malware payload (Loki)", "value": "67e0e642b1b23e29aa9ac9de9746a2c1979df70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914332, "uuid": "c9d681de-acfb-407d-ad5c-7d76048d4dd8", "comment": "Malware payload (Loki)", "value": "f81f6effe18d3416e7192e618f3f600df8608be938baff960093b460d5617fce1c2b73253777e4cd853eea26adefb947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914332, "uuid": "8f193497-8064-45d8-934f-c3b2b377c666", "value": "T157F4011022D88B1AC57F0BF585102131437A6367F467E71B4DC2B4EE2E92BD2569FB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914332, "uuid": "6afa4560-06f4-48d4-89eb-53157baae7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914332, "uuid": "ac256cdd-ea21-4fb2-a522-9696dab99a9b", "value": "12288:LNHHa2iNx5LbzIu9+r9tcEF2ks47Cl1xGPWI42cXGgpUw8o0RNljqp57:Va1j5LA9OEcks26aPWPUw8o0RNxW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914332, "uuid": "ecc7e8c7-8802-4104-81a4-a71cb7b1672e", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914332, "uuid": "1545ebad-3c2e-43da-9531-e7a9adf2c3e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914332, "uuid": "b75bd201-6a4e-4da2-85fc-a3d61acb56c1", "value": "FedEx _723110343717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9494c66-0c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686894290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894290, "uuid": "a645844a-1ed6-4dcc-b3ef-5ed80a1d30e7", "comment": "Malware payload (Rhadamanthys)", "value": "37c7c0b6eba86652038c4671355f60c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894290, "uuid": "1adccb15-a31e-45f1-bbe1-a71242785e8c", "comment": "Malware payload (Rhadamanthys)", "value": "c459a4a1f1b9253dde6e26e12e651c3990ce4f9d1c464308d360dbaf7f82235f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894290, "uuid": "4daf7dc7-9c3c-4550-ab5d-9dd383b0e750", "comment": "Malware payload (Rhadamanthys)", "value": "1cefc4b7104a4f5eaeb1b9b4230aa74917e9cce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894290, "uuid": "2018dca2-9244-440a-966b-524ea7cad9d8", "comment": "Malware payload (Rhadamanthys)", "value": "bd965e8c2ee38b1ca69099e1e0c12912e0e61567167224aaccdfee2f1c79e042239a03208446da4a192eea232adf9cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894290, "uuid": "bf7e02b2-9061-4e75-8d49-de8a4295fb64", "value": "T142C48D03A2E1BD54EA6E5B329F1FD6EC761EF250CE497764221A9B1F06B12B2C173701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894290, "uuid": "ceb31ed0-6e7f-4280-8cc9-d1217d45892d", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894290, "uuid": "cd037f7f-307d-4cfe-8360-711f2e8ac027", "value": "6144:a2uAnlTgEi0gf/lfbBwebzCWtOS3GtEJ8luZ3Rx847U4MIR/9WD1BZ:iklcEs/pB9/CWtZ3SEqE/DVlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894290, "uuid": "983926d2-c1ba-4441-aa1d-0b9d23ac82fe", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894290, "uuid": "30b00594-2711-4977-95f5-36fc5c676fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894290, "uuid": "644a6a09-4800-44e9-9876-f973b39cd334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31e24e3-0be3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686878281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878281, "uuid": "72d9413b-3228-40e4-b2b5-7e56edd180c9", "comment": "Malware payload (Tofsee)", "value": "670db4e79cf8fc8dbf6409b4d342f0c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878281, "uuid": "37e366c8-9088-4b5d-ae38-1b0abc393c73", "comment": "Malware payload (Tofsee)", "value": "c4683b5a739edb952c4679b6ef3b66bb873e626c34e89c6446ef268520149897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878281, "uuid": "1c5d7b66-c5a5-4f3f-bed2-c61dd32b8eb1", "comment": "Malware payload (Tofsee)", "value": "2bf50fc4cfea6b5d35b686687346d94a03e479a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686878281, "uuid": "720e01e2-245d-4b91-b9e0-be749a46829f", "comment": "Malware payload (Tofsee)", "value": "908db43fe9cf85238baba1988f2dfb30cbfac0cfdec65041cc376a22cdf75a6ebee4d5e15e92adb832b374d03ddc54c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878281, "uuid": "7e8f0f54-f136-45c6-a2c8-c4bc7d1663ec", "value": "T11C349E13FEF0A872D6268B728D3EC6E53B1DFD504E346E5B22286A1F19701A1C572379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878281, "uuid": "3b6a1993-29de-4052-9af8-59ff54f6ef68", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878281, "uuid": "8bdbab9f-1fb4-4428-8753-a4a3246a635a", "value": "3072:8yYSsoV/+TyIKzcj9CTI7791UQWtN/AD9EjfDIoHIh:ASs6/+Ty5aKI7791UQsl3IoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686878281, "uuid": "f500d226-a579-415a-a62b-26f80342c1e0", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686878281, "uuid": "149798ac-62bf-4251-8922-025e05c3ac6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686878281, "uuid": "5ce9fcb9-6308-48a8-8727-20af261b6440", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d38b28f-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686925435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925435, "uuid": "3a159524-4e86-4282-baa6-55d3f07d5092", "comment": "Malware payload (Rhadamanthys)", "value": "0cd56622776c370e8fe06876079bd78c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925435, "uuid": "fa2855ab-c212-49ef-b999-589038cadcec", "comment": "Malware payload (Rhadamanthys)", "value": "c48a7a57d515ae7471b153f2346e0286cdb5707683414d54cb8fa45553ac4087", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925435, "uuid": "23c8b7e9-a857-4d0e-aa62-920a9e9a40da", "comment": "Malware payload (Rhadamanthys)", "value": "b330dfea6e1f394be43d702c25b803bd32a35066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925435, "uuid": "06798e19-20ab-4b6f-a98f-d5fe745e4ca2", "comment": "Malware payload (Rhadamanthys)", "value": "01cf7ac281ba3931fd7286aa75ddff68b2271ddba72990f3e7b410e429a0719116d53e41113a22aac1c0022576782e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925435, "uuid": "1d9f0aa2-a76b-4482-8923-bf6894871f1d", "value": "T142C48E13A2F27C51E5768F738E2EC2E8361FF6608F59779E62149B6B04B11B2C163721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925435, "uuid": "8a4b3027-de35-4af7-b384-2da92e86564b", "value": "e712b9ea811eddc692156be9406ceff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925435, "uuid": "14a3862d-fa0b-4cc3-9df5-c26cd737b2c1", "value": "12288:hzN+ckf3yzrLK2kZ+h0wVBLUN3Fr1AinQzb:JN+73ZdZ+h0wVxUN3Frx2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925435, "uuid": "b1f79fdf-9057-46ac-bbf7-69a55d82f92c", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925435, "uuid": "6f4e17ed-168d-41c8-89e4-c4ccfdcbfa14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925435, "uuid": "e02b1e47-43ce-445d-8dbf-166938919c5a", "value": "0cd56622776c370e8fe06876079bd78c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96df3653-0c58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686928512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928512, "uuid": "f26065d1-2f26-422e-a711-bfb35813822b", "comment": "Malware payload (RedLineStealer)", "value": "353a30d947016c2cb7ad4541f0bb92a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928512, "uuid": "3b6de611-b962-4199-9b25-9b615debc2d9", "comment": "Malware payload (RedLineStealer)", "value": "c51777080c74ba56a9483e5086b933ac43ec01330b3808b939f79aa588f2c9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928512, "uuid": "3da2502e-9ec1-4a62-beb2-bf9611a5d5f4", "comment": "Malware payload (RedLineStealer)", "value": "acada36add7bc9435cffcc15489481fcba9ea84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928512, "uuid": "f7916205-cbd5-4961-859f-de80a0aa2eb1", "comment": "Malware payload (RedLineStealer)", "value": "a1917633503dd9921f64b65c04b3ba42a3f6857f42b66341e139e07dd3e635c9401e357716bdef4c7155bcdcf4aa2e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928512, "uuid": "c862778d-23cd-4f04-98c6-d2b0d2bd2815", "value": "T113A44B43A2A27C51E9368F328E2ED7E8761FF5608F5977AE52149B2F05701B2C273721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928512, "uuid": "7fcbd4b3-72d8-4abf-b775-2e3ae384f258", "value": "2ab0162bfd91ce0b6db4856e4b4f264d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928512, "uuid": "4df12628-68ca-46ed-ad16-7e21dcb2f258", "value": "6144:2YkFEm0WeGrVygK0ATEPA5orQ0UISUgeBZI:fTWbxyt0aIqorLDZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686928512, "uuid": "04a1b77c-145d-4028-8a26-6bbd77034683", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686928512, "uuid": "707bf18d-c3f1-46b1-8986-c8374bc02574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928512, "uuid": "2e2b3c04-4d17-4ff9-b367-eb5c2c99c6fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60faec58-0c7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686943454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943454, "uuid": "ea7b67b5-6b7b-4597-a37c-118d0d6b7a6c", "comment": "Malware payload (GCleaner)", "value": "7dcc8e13d05afe860c819ae81c0824e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943454, "uuid": "95a6ebd6-b591-41c2-a9d7-ba74b732447d", "comment": "Malware payload (GCleaner)", "value": "c63c57e2b29e322c79080a5fb21716b8398bcd2880c55ee86662bd7e6250ae32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943454, "uuid": "52bda959-b52d-4d3e-a2c5-54962c83615f", "comment": "Malware payload (GCleaner)", "value": "d35bfe16f3cd15707d674c2dde3c3aacb0a3e846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686943454, "uuid": "9812bcb9-d49e-4923-84ae-e13e8abf517e", "comment": "Malware payload (GCleaner)", "value": "1d65519e7469b82255ba49a85968f526be1422b1bc91af4f2060699f001232d2034c09d7ea77a523f17e04a382c3ee05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943454, "uuid": "6e6a2a48-2a0a-4d6d-bb71-8d4b44e003b1", "value": "T1C2C533E7D34C8CF0E8714BF414EB05698E6B7C2795F2016E16EE312D2E7A6AA0D5D213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943454, "uuid": "6a01c283-9170-4267-a81d-9876ef176e19", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943454, "uuid": "fed8a1e3-8ec0-49fb-9e44-2d3e228d3be6", "value": "49152:U6djijWSzRVyLzwS9nj+39SkRGjTj9Uii6bgZqMP42ikINnljVTnwDOZ:jdGWSzRizvePijbgci7wnl6DOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686943454, "uuid": "6ea4e24c-62ae-49b8-af07-ba168b355cb7", "value": 2633024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686943454, "uuid": "be5a690e-bb80-430e-8a5f-86c09f2bdf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686943454, "uuid": "c252ef02-fbc7-43c9-b17e-91c4ffd30574", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4794bf6-0c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686906335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906335, "uuid": "8f559137-7881-42cd-ba0c-e48bd69262dd", "comment": "Malware payload (Rhadamanthys)", "value": "3464fbc524971b347a3183f9232f8396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906335, "uuid": "2a0baec1-746c-4881-aa53-14eeca3cfca5", "comment": "Malware payload (Rhadamanthys)", "value": "c69be220656f8c1b2f425b778bfee586165ab8653b3550e1c8226398429e18a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906335, "uuid": "e89b3f99-156e-4cf5-bb2f-12978a039d8c", "comment": "Malware payload (Rhadamanthys)", "value": "0d03d03a52a31adc88aa4747fee60ff321d826cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686906335, "uuid": "e63592bb-df04-4dff-8415-4b0bf7fea064", "comment": "Malware payload (Rhadamanthys)", "value": "f9cbf4ec5d51f752f68cadf848c2adfb4ff9e8a37967f6a8eb8ed68d2da933b6a26d9e537d7e160f0c1238a62ae0b6d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906335, "uuid": "9c94991d-336f-4397-94ba-b262158cd94f", "value": "T123C47D03A2E1BD50E9669B728F1FD6EC761EF1A0CF493769311A9B5F09B12B2C163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906335, "uuid": "0d3b699b-835d-4da5-afe7-7b969dd7b2c4", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906335, "uuid": "0516fe2f-d1e8-4c02-8f1b-c97cd8a5a9c6", "value": "6144:Qep7kDghIoGeJd7ApKzc1OV08GAVgVexGhnPRfSkF87eCRDUBSo:LksaWhAnOV0InCZf1WFR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686906335, "uuid": "6daed328-0452-4e6f-9cb8-f42f246f44c1", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686906335, "uuid": "ac4b8f3a-e2ca-483d-bb0b-3e1ce2990c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686906335, "uuid": "644f4978-b1bc-4f28-9ab1-929c1c05548f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795f7600-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897539, "uuid": "4e6c479a-2763-44d6-ac68-1daba4f0f728", "comment": "Malware payload (Mirai)", "value": "312e2597777b7a00a76421e53dac3b28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897539, "uuid": "bc16d335-e9cd-4f71-b276-b9346a26d3ad", "comment": "Malware payload (Mirai)", "value": "c6b591cb54ac3c9dca2e90628142442d8269e69dd41c7909e3a7c741d4f2b7bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897539, "uuid": "51462c75-712d-4859-9f39-82c62a7f5e5f", "comment": "Malware payload (Mirai)", "value": "cc7184ebe7bef80e8031c92f0a44545cb447df3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897539, "uuid": "356a91ad-4782-4f85-8898-524cac22e570", "comment": "Malware payload (Mirai)", "value": "5421507a76f260964cdfee94b331fcf016dbb3dafda4138f2c62ca01e297c98d3498214f2c669bc60f29e0c9c9533e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897539, "uuid": "1ed0e88d-cb5b-48bc-a4fc-114c389662e5", "value": "T10033029A7F3974E1E3099431E30C36F47628637145219FE991372F880CD50AB91B7969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897539, "uuid": "22fcc89e-bbe7-4ee8-b821-8abc0c46db0e", "value": "1536:THoWhJ8biqnu5LCsl4ddYhMeOx26xr4PK2:ToWhSbiqnutBl4U/u26xcy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897539, "uuid": "f4baf574-9ff0-40a1-8783-10b082d4b5a1", "value": 50944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897539, "uuid": "8e6eec0e-040b-4dc0-b390-d3b15bb1bc41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897539, "uuid": "e411be78-f4b9-4da8-8f7e-72ac4de6d02e", "value": "312e2597777b7a00a76421e53dac3b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e73fb35-0c5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686929652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929652, "uuid": "86b281ae-c026-463b-b8f7-5bc5a4f39bdb", "comment": "Malware payload (AgentTesla)", "value": "fe43f2d8b179c677c8cb53ab4fa19e55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929652, "uuid": "9b55f0b3-bf41-430e-9929-32949b464069", "comment": "Malware payload (AgentTesla)", "value": "c7709eedf4730a691a8ae7d73a0e8ccf5642c97317428947a7f6257ed6b30d6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929652, "uuid": "f9810f07-bb87-427b-a9bc-d7779517d740", "comment": "Malware payload (AgentTesla)", "value": "a6b7caf6b7182532d30d5b8ef8d3110c4927aa35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929652, "uuid": "39167e0a-ac0c-42d3-8c42-379ff403e892", "comment": "Malware payload (AgentTesla)", "value": "b8925e597d83428be12235fbcb877472df5f13eb3d6d8578c2ba34f569091d80a7c1a96be14796ff8fef727c30f243ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929652, "uuid": "7a3d963b-6555-499d-aade-7fab54759a63", "value": "T14EF4010572BB5F6BD43E6BFC0A145232C3FC4959B023E6526FD36ADEAD20F444A90987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929652, "uuid": "21f63054-3512-4619-bd91-9c373e7cb978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929652, "uuid": "73f6c022-eca1-418a-8894-c3d0d4386c90", "value": "12288:zj2iNyOe42KMu/N3mWhQmwmJCMpUJY2HfjEqXTTuEj6tZSf5oy7WBMPyayPlwHzw:v1wOV/NOaeY2Hr/TiEj2SxopBLay0gY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929652, "uuid": "7cc9679b-74ae-498f-be71-f79b1f3dc9bb", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929652, "uuid": "10e714bf-7f12-411a-8a09-a789821fb548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929652, "uuid": "4359bc3e-6823-4f0d-ab43-dfa9a80aefcc", "value": "ORDER_CONFIRMATION_CAHF2310445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b067f1f6-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686894624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894624, "uuid": "1b226d78-33ed-49b2-bee3-f4dec28a11ef", "comment": "Malware payload (AgentTesla)", "value": "ff7a81967d14136f9fc5ec8990d851f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894624, "uuid": "8f8c24b9-f536-46f9-b896-bf5c212870b5", "comment": "Malware payload (AgentTesla)", "value": "c7b95632025177e42114517f2fd2d3f00dec812b6d394b3966a13a0ce831629d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894624, "uuid": "f6e0320e-d393-4377-bfd2-6f79c5a9f847", "comment": "Malware payload (AgentTesla)", "value": "05e53f1e159a0ea0e1fc42bb464d09a0af31e02e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894624, "uuid": "31b69462-d6ed-4da3-aeda-0a157028fe97", "comment": "Malware payload (AgentTesla)", "value": "96009128b2a6bf6aa68ba351f2af9c31f7f7aeaee90f41d19e8eb0a91460081a8e6a8bf4241072dbded3a50224281cc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894624, "uuid": "9d97510e-07a4-4ae3-8f81-0ec66c2ab526", "value": "T1C54502444EFABA8DF898727F6230F13546F2CC9E9C31C6A42DE6B9D74B9C086509607D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894624, "uuid": "6d2231e1-f253-432c-9c20-844f51f03ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894624, "uuid": "b5c7fb11-989f-4e3e-862e-7f5c73ae62a3", "value": "12288:6XTCge+nHZLNKGe411cRkpa6SCHLvf5bs7MpMNNdSwfoaftJ:VQL3nK9foaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894624, "uuid": "ce964b18-98a9-4811-8f53-373b8fdb93d4", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894624, "uuid": "6d773862-0bf7-48be-83dc-62b69757d4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894624, "uuid": "b5ddbcf6-5d72-47f0-8b2d-d739aa1e92be", "value": "20231506_ nr zs- REV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e49885-0c4c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686923187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923187, "uuid": "3576ad79-4137-4297-9638-a74b6799a7a9", "comment": "Malware payload (AgentTesla)", "value": "b12ed68cdbac917994444b5d30d84043", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923187, "uuid": "2dbdc045-f791-4e9e-8a46-bf9bb28df7a5", "comment": "Malware payload (AgentTesla)", "value": "c81a1afc4f9e8588907d1cdb78b0bb50ab10a5a4cffe2022ad8dfa1e749a6ca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923187, "uuid": "1b2fda0c-765e-4cd8-b88a-d3075b188df7", "comment": "Malware payload (AgentTesla)", "value": "137fb253ae433cabddfebba9c9e541cc49b8f8ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923187, "uuid": "f78e49b8-e35d-4c98-85d8-636e058d299c", "comment": "Malware payload (AgentTesla)", "value": "33ca8d4b0b230f7f209dc5ea2f7577b054247a9e601e5aa4b472173f69c839e9a456f48899018170007d3ed41e579745", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923187, "uuid": "3f3efb65-d8fb-4d83-a309-eab4b265889f", "value": "T172851222F585986DF985C73519D274AA811C7D63BDCCA809228B331F3733BE29B33649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923187, "uuid": "09a2d7f0-d453-475e-bdbc-e8447b7edd44", "value": "24576:Eu9VDt6IE3ziabzu9VSt6IE3ziabUnaWsyVZWgSPqkZjl1F:EuLt6Iza3uKt6IzaGs6NSS0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686923187, "uuid": "b4036cd3-dbbf-448f-98cb-dc6acc231dd9", "value": 1735680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686923187, "uuid": "862059f1-3411-4ab0-988d-b1a4a3597365", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923187, "uuid": "e2e2f4fc-a895-4dc1-baf6-a95575d424c0", "value": "PO207790.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6b806b-0c4f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686924416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924416, "uuid": "84216d04-5db7-42fb-9fca-90cdf6557091", "comment": "Malware payload (AgentTesla)", "value": "dd41d187572b44704ba81f9ba60fdfd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924416, "uuid": "7999f461-6608-4c4e-8721-9250b06f8b24", "comment": "Malware payload (AgentTesla)", "value": "c8a8ebf2ee4a00602286b70f837becf65f5237df00df1a6bcbcd37ab2c0aac7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924416, "uuid": "7f3d39e4-71af-43c3-a2e1-75f71fca120c", "comment": "Malware payload (AgentTesla)", "value": "08ae46729a934d6bcb9152f66f4a17224d0674d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686924416, "uuid": "4936d084-b9bd-4047-bc16-c60b45ba60b8", "comment": "Malware payload (AgentTesla)", "value": "d6843202e1d9539150ae99a9ef5669d69658990429788aadf05b17cc3c84fb238cc8c5cabc1128cc158fbd4c613edc7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924416, "uuid": "010173fb-03d9-40e0-b0b6-6fa5a4e730db", "value": "T1E105025496BD470BDAFB17F469A581300BB2B56B353AD35F1E41B0EA6B32B214B02F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924416, "uuid": "4f0b05b4-9798-43c2-abb9-d8892715ac61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924416, "uuid": "e46fe215-2461-452a-bc2e-6650433ac40f", "value": "12288:nVPJKUugEIM3/QlzGkRnzGe5yMxZviE4iygomswoEXqXdVL:nF4UR/MPazGkRnzx59vih4qXdVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686924416, "uuid": "6b16e0ef-5b36-4208-83dc-04abee515fb9", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686924416, "uuid": "2a20e2e6-f38e-4346-9e7b-ce5bf208819f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686924416, "uuid": "4333bc02-a9ea-4ce0-8dee-bacfc9774e74", "value": "Remittance Advice -(DS78B) Payment# 133060908_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b7b2f-0bdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686875549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875549, "uuid": "b8b42bdf-51cb-49a3-9ae7-eea665e984c6", "comment": "Malware payload", "value": "93602988ae77d09613324a38052811e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875549, "uuid": "5c169aa4-f472-467d-8674-bcd06e510dbf", "comment": "Malware payload", "value": "c8cbf1cf402f1cbf5f9fc0e03e073aa0c21efc961d160d57a02cf3cc8d1b6a79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875549, "uuid": "63f3fe0f-0066-49e9-90f9-c68e7184c1b2", "comment": "Malware payload", "value": "152d49fb3e330575543836e4575c325aa2edf313", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686875549, "uuid": "6bd849d0-853a-42b3-a7a3-3f874faf468c", "comment": "Malware payload", "value": "1f15d1a09d8c0b2704b33ad7ba63f328062a16b850c3be86fccce5943c00aeff770620bcc53cf69d81f373f9f680335f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875549, "uuid": "4acc0b79-1302-4bdd-ad78-3ef41f03d15d", "value": "T1A964BF61F1E09879E1FD093CDC22C7F7576F6371EF4074AB214621A98AA8780ED37626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875549, "uuid": "11b5da41-d92b-4057-b62e-5c3b15c0ea1f", "value": "8bdcbfa1a4d3bacf7d5e4d096aabe642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875549, "uuid": "8c36ee04-eae3-4046-bee1-81908d99d65e", "value": "6144:g/n7fv9L/FCR0l0N0pepeQGQ5Xp4ZQE0O3eVLIKJYeRXS:g/nzrCRI02MoVQPnhPJIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686875549, "uuid": "d98850ba-1185-473a-92fb-eae406dbb8b2", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686875549, "uuid": "e7b833df-98bd-4e03-a738-4a42ab58f9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686875549, "uuid": "2619e37b-9c4b-4c65-bd58-fc3b938aeb7f", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.EBB5E5E1.21310.16662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17763077-0c9f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686958792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958792, "uuid": "3dd236fc-70dc-45dd-978a-60b453bbae3b", "comment": "Malware payload", "value": "32262481df1855d46c85453fc1ce3894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958792, "uuid": "4d8fc4db-6674-4506-a11c-5b296cfb3bd8", "comment": "Malware payload", "value": "c99798d67cbf1e80040257eb9e68f62d966fe53443ca54e120e3a0379152ca80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958792, "uuid": "7d38d3b3-0bc4-4715-8788-4228979f4124", "comment": "Malware payload", "value": "ac238a2d4d1b767eeef4bc11211935158ea04916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686958792, "uuid": "31b4425c-c381-449c-9905-29cc3f88f450", "comment": "Malware payload", "value": "b4a15827b400d623d88fc8d77e11c1a71f334c9e194df4f756b46365e0cb69803d4ab82e15ad0aae274cd112e1c7538a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958792, "uuid": "0c4750c6-6a80-4d6d-8838-d758766f4cb4", "value": "T10EB44943D6F23D44EA768F728E2EC2E8725FF6518E49BB6D5118DB2B00B1172D263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958792, "uuid": "fedf39eb-b76b-46e8-b994-d0d3bbe9647b", "value": "f719d133eb0a7f30a0b9bd8ad8b269ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958792, "uuid": "2ddf06cd-ffd5-4207-88b3-b51d4c2a8b5f", "value": "6144:ZcIh5dHEeTfxgErpyLU2e+oCLCy3a2zmeF2PkhlknBY46kEB7909:ZcfeTJgGmU5C+yqkFph6nBYxD79I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686958792, "uuid": "8dfc7629-5f74-457c-95f6-71e25e9a6d1c", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686958792, "uuid": "338364f4-ec5f-4c5b-97a4-21a69d68c0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686958792, "uuid": "01b0acd1-53c8-4a8b-91f6-15843223d438", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865986f3-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686925478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925478, "uuid": "bb2feb62-32e5-4f29-aebb-2b0ddc97940c", "comment": "Malware payload (Amadey)", "value": "759ae5ec8fb39464ea90703665b2588b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925478, "uuid": "9a7deb6a-854a-4260-acc5-70d9b1e9c0aa", "comment": "Malware payload (Amadey)", "value": "c9ec54189e36ee057b3c134c6118d18046e0b808d352d68ddee33ff58e0d047f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925478, "uuid": "6475c112-a4d7-4f2f-b558-a52f43fb473a", "comment": "Malware payload (Amadey)", "value": "59ced86294eaa3fa2fd77490d507f467207167ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925478, "uuid": "75815ad1-1414-443b-b2f9-8b8fe7c13c2e", "comment": "Malware payload (Amadey)", "value": "649d8e6d5a790155048beaf810c2953516b939127cafa4d452792894b56dca6ad94f99c1dd207cf97429e1b07514f933", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925478, "uuid": "60fa1802-05fd-4a81-9411-24d8ca16a317", "value": "T152051207AAD88432D8F127B09CF907831E367C86ADB4935B178AAD5F1C33694993477E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925478, "uuid": "36ff78a3-9c31-4ce4-95f4-4c0630b41d9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925478, "uuid": "b9e207b7-2ad3-4c9b-8296-d4d8f87c86bb", "value": "24576:RyE+aqfI9dFcBhU3vXwXRucKjz47ynmWkETO:ETdf02hU3vXm54nmWkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925478, "uuid": "e8709102-84d7-458a-bcc0-31613a0464d1", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925478, "uuid": "1f663044-dcb1-4089-9802-5419be847ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925478, "uuid": "7f951d93-d380-4f62-be0b-324b1e7906cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1758c1-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686925514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925514, "uuid": "db7364d7-b4a8-466e-afbe-3910571ff4d1", "comment": "Malware payload (RedLineStealer)", "value": "032c5f98d2377ab22c949bec147e672d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925514, "uuid": "f365e025-e371-48b1-bbfd-d4484d8fbc1b", "comment": "Malware payload (RedLineStealer)", "value": "ca5143c7654ec33c97833b105d6a9de379121ae97c9a5a6e412a7c3103fe37b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925514, "uuid": "5b9b50fe-a7ab-4217-824c-d7d2e4faa192", "comment": "Malware payload (RedLineStealer)", "value": "23e9d6cf31a16d5ad9f02f3997c9fc34a1659356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925514, "uuid": "f332c879-9ac6-4160-80da-243c4c4b4dd7", "comment": "Malware payload (RedLineStealer)", "value": "24bff8af7f624728fe8af16a10195720f4a85c78690d0be1289e77bca802d7c6ff8b61a442b0e5b051eae05b1a32b07f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925514, "uuid": "cb1a6171-992e-4c03-a9c3-113fbb1b18bb", "value": "T148D35A9537D98A29E5FD0B74A4B1003A43F0F8136511DB9FAFC1B0DF1A35BC0B6266A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925514, "uuid": "896f03bb-8ea2-4b63-91ac-4ae8a171ec4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925514, "uuid": "35b8d7d1-c8b3-46ae-b21d-d94e35a155ef", "value": "1536:kaWcnVHT1C/o78p4g+fXCvNKBowMtIT/hbj8ebV7r/XkBusYgibfbFDKsRf:RWcZZ46PCv8y+lEqN/sYgafJlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925514, "uuid": "fe5cca06-c40b-403e-a5a5-fb59d7f61839", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925514, "uuid": "49dd9769-25e5-4a3e-b117-37968e01f4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925514, "uuid": "1ab8e232-73db-4f97-bf28-df369325fdf1", "value": "032c5f98d2377ab22c949bec147e672d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6faba07-0c34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686913104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913104, "uuid": "7485891c-b7d9-449d-b6d2-ba2dc6c3498e", "comment": "Malware payload (CoinMiner)", "value": "88cff82a7648a4270d63326bb21e97ab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913104, "uuid": "9bf5ea27-5f14-49ff-a8f6-7eca2a159682", "comment": "Malware payload (CoinMiner)", "value": "ca85de6291790563c305f3ba54d58622585104ab5db18f6b9933afaf891bff9d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913104, "uuid": "383d4d5a-fec0-4217-97df-6eb85cc7d8d2", "comment": "Malware payload (CoinMiner)", "value": "9d3214d4490a0dad2e80bfd8302ed5c534dd1093", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913104, "uuid": "876f4f2b-0508-4b50-b83b-3f3e3bf62328", "comment": "Malware payload (CoinMiner)", "value": "39c840f6778f5626bb4d29eeb6878bbad7fc2b4e85ec298ca539ab946fc6fc03f1cf06922132c20c611d47442155807d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913104, "uuid": "661b0aaa-8e65-45be-9670-02cbd66e4095", "value": "T190642A1362E4BD50E6A65B328F3FD6EC761FF210CE597769121A9B2F06712B2C163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913104, "uuid": "8aaeca52-fef9-4638-94fd-8acee49c24fb", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913104, "uuid": "30a98e8c-c5a8-4f47-bc41-ef8e8a38e726", "value": "3072:QSnk7H19VtUbu8ndjn9LHjghfp+sYFXTXcK/+5LGrpay426W5SwQkIKB:Bk7V9r0ndjn9LHKYFDPcGrp62ACD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913104, "uuid": "2adaefa3-f616-457d-ae4c-77652bd63ff2", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913104, "uuid": "c91c91c4-e0a2-47cc-867b-8453149ef722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913104, "uuid": "e26e10b3-2d90-405a-9f22-4276e763a149", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33d9c1b-0c44-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686920050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686920050, "uuid": "f5fed25b-fa70-4ec0-970c-bb24d7972be4", "comment": "Malware payload (AgentTesla)", "value": "cfbab596553f0380d0a9c5d5a866b2d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686920050, "uuid": "039262bf-b750-4708-8159-9626fbc3deae", "comment": "Malware payload (AgentTesla)", "value": "cbbc5f54c9881799f1acef2bbfe3b81dd01242fd9694bd6ee9deaa44d90319ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686920050, "uuid": "6189b5f4-d690-4e58-9f68-d2c89a9f2b81", "comment": "Malware payload (AgentTesla)", "value": "4a9f324ebdef73ac81b7f0c3866c749d4486f18e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686920050, "uuid": "58ee6e47-0c72-414f-8ff9-c16c5d474dec", "comment": "Malware payload (AgentTesla)", "value": "5214c85e916cbc9dc60ea5d5276fe80b5c39ff589113ef1899c1844391bb4e9fd7c2b8abd833def737eb34802077c10e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686920050, "uuid": "10278a19-2bec-442b-b190-f66ec44b07d2", "value": "T12A6402587F404E4AC433567184299B592E97EE90E4541D8633F3BA1FEC33DE18ACA7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686920050, "uuid": "ae9ffced-ca2e-4b0b-a912-b3a7393d535f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686920050, "uuid": "fa50e2a2-f373-4b21-ac1a-081e114070ee", "value": "6144:wYa6SiXa8oNWzyvICypXRqI5TZ9z1TsJQpi7gH0cr0dSE2HZ7:wYgiXTxOLqXAiJgQpVHL0oEg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686920050, "uuid": "3eba853e-76e5-4616-a282-c47a5ce94efd", "value": 322641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686920050, "uuid": "1f4593db-ab14-46d1-91a5-4bef4975f34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686920050, "uuid": "fc1ce906-98b3-4d43-b5fd-4cacf1fe5c8d", "value": "JUNE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bdb201-0c07-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686893669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893669, "uuid": "6634040d-6b4d-41a9-9055-cefcd2b58e0b", "comment": "Malware payload (RedLineStealer)", "value": "21075ddf63e686c68e95d549814953bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893669, "uuid": "6be2576c-459b-4c6f-8d6b-676204d9526a", "comment": "Malware payload (RedLineStealer)", "value": "ccb6aef1741c370192d1af595e57ae1ae67c28101b934f1fc7303a5bb778d51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893669, "uuid": "f743bb73-cece-4018-92d4-4477c9282da6", "comment": "Malware payload (RedLineStealer)", "value": "17f39cc93d74edeb96411c8a56db1946058239d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893669, "uuid": "5f35c203-2e6b-4e12-8dab-f37fa535caba", "comment": "Malware payload (RedLineStealer)", "value": "bfb2537bfdf5ec4a0401d7c523e21ce66d4576ffae28f43d300cc2acbd456844bd2feccc9536b74b494556d25320ecb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893669, "uuid": "3e89a4c3-b52a-4147-b2fa-63479ea4c679", "value": "T152A44B03A3E1BD54EA665B728F2FD6EC761EF250CE497769221A9B1F01B13B2C163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893669, "uuid": "51c901f2-e917-400f-bf9d-585323c1abdb", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893669, "uuid": "2c833268-c8a3-4633-bc83-99ca097e05fa", "value": "6144:PwyuAtl0k5H+yM/oh3YkRs9zBI9AnmnoDcbDHI:J1taksyMAhIkRs4GJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686893669, "uuid": "0d82f894-2c1b-4676-86e2-336c160fc43f", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686893669, "uuid": "473f1dfa-bd86-49eb-90a3-885ddd37f668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893669, "uuid": "d0d02778-92d0-47be-a3c4-24892130d278", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874d00ec-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686937076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937076, "uuid": "4d74df16-e28e-43a0-ba03-0e47d045bb15", "comment": "Malware payload (ArkeiStealer)", "value": "c80a9ed1b5b76111f08e1f6adbd5d374", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937076, "uuid": "8aea7f6b-0f5d-4c5d-9650-b26f4d7b6ba7", "comment": "Malware payload (ArkeiStealer)", "value": "ccc00314a3d2a7918587d59019b032578fafdb813abb5214899a5ab022d89d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937076, "uuid": "3291eaae-1b5a-4c96-b4a8-450be7541a47", "comment": "Malware payload (ArkeiStealer)", "value": "3e793f18cc24739ea3a36f3216de85f0fe4026bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937076, "uuid": "ade0c305-a111-41aa-933d-6580a4c0984a", "comment": "Malware payload (ArkeiStealer)", "value": "933a4a1e782a7b5224654538eedb94fa1218bd94276dc989710cddc1ad79f31ab280dcd7cd191fd92a76841e33e83a8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937076, "uuid": "4da14dfe-4421-41ca-abf6-8cf86affaf57", "value": "T18C947D13A3E17D50E6AA5B328F2FD6EC771FF1108E597B65122A9B2F0670276C163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937076, "uuid": "58b6787b-2f04-4167-b00d-151bce61e173", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937076, "uuid": "f9f261a7-b31e-4667-869b-6386d26b13f3", "value": "6144:XjUrVvyZnn0yRKoyTNrAeuZ7TUOPvjSjrVLvOLPRhk:Q56ZnUtTVnuRAO3j8V6Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937076, "uuid": "7176f439-f054-4adb-8a4f-8d9c70dce2d9", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937076, "uuid": "97f67313-a35b-473a-bec4-0f4c8df92ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937076, "uuid": "a438c937-1390-43c1-8386-f7057e4168a4", "value": "c80a9ed1b5b76111f08e1f6adbd5d374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28272635-0c14-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686899120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686899120, "uuid": "3215fd57-be7f-4568-8a0a-8d4ae32e220a", "comment": "Malware payload", "value": "4ad41ee274d61d14f39d8c4b7ae98e11", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686899120, "uuid": "5e9d2f5c-48fb-41b8-9b87-1bd9ff9b4db7", "comment": "Malware payload", "value": "cce7239bdbbd3f26d202eb44d86e4ac3b4c519c1946ee798ee5cab1b4be94d82", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686899120, "uuid": "cd4fe6a6-4c80-43c8-bb12-d1ce4f3287b3", "comment": "Malware payload", "value": "981a96cc8db719abd9bf18833224fdf02b861c61", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686899120, "uuid": "8be24eb3-17dc-4f46-8584-a8997e7f2c09", "comment": "Malware payload", "value": "bea645720e4474a81becd9935192d822a1803592fe74e3897681569fe7a80e71e59c88bcd8ade28439b19264fbba1984", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686899120, "uuid": "5e1c445e-8a59-45ff-9856-82a908940676", "value": "T1A8C178833197B89A018243BB3A5557EA047AC724A18A6044F7DC9F9EFCCEE537A4D3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686899120, "uuid": "203ae8fe-c872-464d-88e4-37aa0895eccf", "value": "96:7gfovvOm0+o0lcifX0lP014CHuS7WFNgQfRJL0W9qwbVCnzHHNO0lCo0lRV:JvOvMGGkW14BFoW9qwbVCnzHHNb47V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686899120, "uuid": "bc40a567-27e6-4dcb-afc3-db6d9b88ff0a", "value": 6127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686899120, "uuid": "2931a57b-3203-4a00-b406-182cbd04c626", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686899120, "uuid": "f54f5e2e-6036-46d4-bfc8-f16b9b4fffad", "value": "kvZd9QfH.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54ac335-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686914389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914389, "uuid": "f276e4ee-7878-4f57-a0fc-c94962283290", "comment": "Malware payload (Mirai)", "value": "353963e6329c393baf4968ce2d28aa68", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914389, "uuid": "14b505d3-4fb1-45e6-8360-92d8755a4803", "comment": "Malware payload (Mirai)", "value": "cdf0fb5e46c525a99f055b4861c0940152848527cb937334350293d3bc31bfa3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914389, "uuid": "01815c32-3c6a-4f59-8185-fbe1c253771d", "comment": "Malware payload (Mirai)", "value": "fb54e5e6652c5e134045766d0df3286a159be9a7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914389, "uuid": "e674fd0a-692f-44fb-b098-440a715bcb92", "comment": "Malware payload (Mirai)", "value": "993ab60e31549aaa0ee4be569fe857d9938be9b8ac3d7484b93bb7aad5538d0b003a5964d6759f11953f5149e71733d6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914389, "uuid": "1b086089-4f19-440d-87c1-07b2da50ae0f", "value": "T17613E1BE8FB06E1AC469433FE5FB68080556B55C881EDF43A5982CD452919F2AC12FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914389, "uuid": "bdf33ceb-2630-4837-994b-1399b7ab7b8a", "value": "768:D5Gacsgmj62v4w5bhIW2HG8tQ3altHVzJncPTmSaHbCddGNJGHqXe6x:1ksK2v4wBh2HztC6Vyd4Xe6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914389, "uuid": "c14b910a-af48-45dd-a799-918c27824338", "value": 43028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914389, "uuid": "31f5afb6-e07c-4a61-8257-1171c608701f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914389, "uuid": "728a1d8f-be86-4699-84e7-0c49d1031c7e", "value": "353963e6329c393baf4968ce2d28aa68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e4b667-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1686894659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894659, "uuid": "22ae5447-c6c5-4608-a81a-6b75a12f82ae", "comment": "Malware payload (Adware.Neoreklami)", "value": "2fdb08ae6017ed24b946db7c3b451985", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894659, "uuid": "6494264b-b98a-4412-8785-168216a46938", "comment": "Malware payload (Adware.Neoreklami)", "value": "ceb5f3d9bcb6edff6f6d41b54ac9ea95615a45f434fa7997cfade5954872bea3", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894659, "uuid": "8b121d72-1cb6-4214-9ed7-0f9415542425", "comment": "Malware payload (Adware.Neoreklami)", "value": "d7ec68526eb2a2659fb81ea25d6de600cb200265", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894659, "uuid": "7ea5be83-3b14-4dd7-859f-73e00a395eb2", "comment": "Malware payload (Adware.Neoreklami)", "value": "0fc04064a906b308e9e970e4a754cb8f687c6a06ff6505d500b29e997c58f2e2a7f4052dcec433fe56e225ee3ff08f0a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894659, "uuid": "6fdfb453-851c-4c15-847a-0bf9052851a5", "value": "T1757633B135D0C6FAF0F405B340A97F98F2D8E15D1F2B4A2F976A984A7C6EC4C94142A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894659, "uuid": "6420d1cb-ff7c-40d1-84b7-18801839835a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894659, "uuid": "9fbdc1e7-36d6-4e74-9dd6-cff590612d5d", "value": "196608:91O1YgYJ2qxusCq48whveAZb1mif7NaCn4Rm9IK:3O1w2ns9Rwhvt9z8CxIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894659, "uuid": "631cadff-9ce8-407b-9fb8-4ea90079ddaf", "value": 7639429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894659, "uuid": "b175e201-d60d-47d5-8263-1b647fa1ee00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894659, "uuid": "346a314b-9621-42fc-ac39-a3af887eb9ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f0346e-0be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686877595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877595, "uuid": "2cf8afe3-4b96-4ac3-a469-36d2c576f6c7", "comment": "Malware payload (RedLineStealer)", "value": "ffc74619c348eeb09fc65b6137161871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877595, "uuid": "205be4df-a501-48ad-88e4-4dd79b19a187", "comment": "Malware payload (RedLineStealer)", "value": "ceea0cb9fabe3d2369c55cb71c336afa9218a49d1a8a023b1844e8b3ee5bb0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877595, "uuid": "a9e254da-1c3e-4dac-bc01-cb7353f8f826", "comment": "Malware payload (RedLineStealer)", "value": "f11da6fead4ac0b0f96b8b27027fe36c10f8db92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877595, "uuid": "2d0eedcd-6034-4b1a-9c3b-16e8b4316aa2", "comment": "Malware payload (RedLineStealer)", "value": "ac5fb92c375933a2dd74ee07d33edc3db1d66171810073592d70099da4716de460ebfcb65f24a888f957b3b7a771a46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877595, "uuid": "2a7812de-7e2d-4174-89ed-161ffaf41d56", "value": "T1BA64DF12FDF26C32D6268A728D7AC2E5375DF8908E14679B222C6B3F09711A0C573779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877595, "uuid": "4f32c025-1d10-4bfd-8883-e3ca4cc42d2c", "value": "a906842d3a12e68a8de3680faf4710f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877595, "uuid": "db4c34ee-9f6b-4330-a0a5-5f1dc8cc8b5a", "value": "6144:eCKRziZ3p0ytVM561hx/eNHiPl+/lNrvoH:eCAzil6yLOahVl+NNrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877595, "uuid": "70c021b9-ff74-4f74-bdbe-73d9e536e33b", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877595, "uuid": "1b921f8c-50a7-4165-aa53-963235385eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877595, "uuid": "4c5a0058-6548-4a51-8ee3-4779b0d064bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b0dd0c-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686894504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894504, "uuid": "26a48d57-d042-490d-88da-458a3f8b9b6b", "comment": "Malware payload (StrelaStealer)", "value": "17f46833b1bc68b633d87096e2554211", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894504, "uuid": "bdac0e0a-1bea-4f11-983c-b16120e04431", "comment": "Malware payload (StrelaStealer)", "value": "d01f48387858ae24bd9cb56464a3583d4c63b3ff1429c9dd78b1b5b6fc1ac969", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894504, "uuid": "011c23fe-f7d3-43a4-9b0e-b616bcd925c0", "comment": "Malware payload (StrelaStealer)", "value": "caec4514c2ffeeb990f060f7d23939b3fae3616f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894504, "uuid": "ce2e7b79-1374-4c71-b83b-f49913306e02", "comment": "Malware payload (StrelaStealer)", "value": "245188fac3fc2410a64be84ac340366362ce34d152ac6adc8631e3e1af9c543fe68094c4e0ab68bee19270f9e4caf42b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894504, "uuid": "ac2c2a58-6a0e-4ba4-82cd-e83e9721c2a8", "value": "T19125FD0955A8130EC2323BEEAB6D34D2C3709A1776F9C9E3859DB7A2DD5DC368B70424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894504, "uuid": "9d4f02a8-dafd-4c14-846b-e168703949cb", "value": "24576:4whGo0174uWj+JO459UceUOPwHuVUVJHBcF1+kNXoIv9kB94LLb+J:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894504, "uuid": "b394921c-1d6d-4c11-898f-862e77d2f01a", "value": 1005643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894504, "uuid": "c3dc0734-eea3-4122-bc7d-83cc6ed19ac0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894504, "uuid": "d095bd51-b944-417c-b806-8612a3c8696a", "value": "bis.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a08ed77-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686914344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914344, "uuid": "a47d9f57-ee90-49ff-9255-7f9f4b7f3b8b", "comment": "Malware payload (AgentTesla)", "value": "201e4413832c463f30adfb4c7d81617e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914344, "uuid": "f4080c66-3ecb-495e-a0d4-b53765e16340", "comment": "Malware payload (AgentTesla)", "value": "d0e55dd7e642a2550640ddfc5640cae323fcf94d4b0e1fbd67c2c5ff22db447d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914344, "uuid": "a9af6b20-fb24-4ab2-b5a3-416a7bd106bb", "comment": "Malware payload (AgentTesla)", "value": "33f70cf4951962c526b46a103f06045108c93eda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914344, "uuid": "f62c7b29-c20e-4cd4-bad3-55736b223126", "comment": "Malware payload (AgentTesla)", "value": "81e61473f5ae6e0bbc517fde5d2e415a2ae9bade3fc1fde7ff4f5269261b979a47d63775581a2bc5ce653f85de003da9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914344, "uuid": "dece26fe-cb05-42c8-8eed-b000877d5875", "value": "T1D874F1187E408E1AD43306B144360B1A5E6BEE65E8101D5B33F37A5FF877DE1A9C92B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914344, "uuid": "8e59c98f-e35a-423f-bc7c-f30241fd15e4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914344, "uuid": "a7565ee1-d76a-4ef7-a75b-5ceb6ee1b401", "value": "6144:wYa6MkNxy0BO5RbbuNFKnBgvP6teC7VU0x5GvDghFlq:wYukNE0sPbyN96teqv5mOlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914344, "uuid": "4190516d-0d55-4fe0-b800-0feb285ebc08", "value": 340163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914344, "uuid": "4174c969-644c-4ccc-b4ac-e6021a3e99f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914344, "uuid": "bcf11050-66c8-49f1-b411-712a19cb0467", "value": "BANK TRANSFER COPY WIRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c364c58f-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900669, "uuid": "72e72c2e-d6f5-4ea1-a609-14bb24033842", "comment": "Malware payload (Mirai)", "value": "ff0a1af8b003a7e126d3b8af521b9f10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900669, "uuid": "67581853-486f-4d90-b051-9a0309bee1f0", "comment": "Malware payload (Mirai)", "value": "d2443bb451632d57600c096a5a08683fc24d67281560f0f925324be1991aa01f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900669, "uuid": "f7f960ac-41a1-434b-9697-358b9a605186", "comment": "Malware payload (Mirai)", "value": "390505d5c1e6cffec45321899f69344962056fec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900669, "uuid": "e239be20-06cd-4c0e-890d-3504b36de441", "comment": "Malware payload (Mirai)", "value": "7b601bfd4759ddc1297f8fc85ec2ab93f34aedc57ff490195c1205a12dc939f0dd25908c7848dd4920c3238ece7e886d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900669, "uuid": "425b557b-d74e-47f2-b061-e23ea5bbe3ae", "value": "T128B2E1ED92152002C774A87EE9FECF86E5C969BAC24735A02151DA206AC5C1503B6FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900669, "uuid": "60bcc145-259c-4374-9949-84ba0c559505", "value": "384:ShjN6ksGOPr0YNfFLUjMnPgY3w0aPYBwWuPGhymdGUop5h5d:ShjMV5Pr0YNfZU4nPgc/027eGs3Uoznd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900669, "uuid": "798fc97d-4770-4cd1-ac4d-55776590c534", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900669, "uuid": "ebd02352-de45-4162-afb3-20d5d639ceba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900669, "uuid": "f5567c97-23a9-4af2-bb44-48320e914536", "value": "ff0a1af8b003a7e126d3b8af521b9f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09c93be-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900262, "uuid": "58b30bf3-29c3-4f9d-91bc-3120b3ea1dff", "comment": "Malware payload (Mirai)", "value": "3c722860b9cebd228059550a8d1b8ff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900262, "uuid": "61cd0749-7db1-4f37-82ef-5305b6da8b38", "comment": "Malware payload (Mirai)", "value": "d33f1a1b62c3e4f242efed17468da1da426d9c48e28702a10cde0f32459edae2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900262, "uuid": "9e9d146c-4c74-4909-aba8-ddea0372dc80", "comment": "Malware payload (Mirai)", "value": "547e94dcffd5a7ecf9325775155eea1bd0deeb81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900262, "uuid": "3182d239-ae0f-481d-83d9-d10a956e742c", "comment": "Malware payload (Mirai)", "value": "ba5308960fbe0a6e5fab0a8a44eb622186091d98bc788a097810339e3ed38295cb7d963e4c39f50ce6151da1f255db88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900262, "uuid": "c245b020-7057-4efa-8c70-0dd6f00292ca", "value": "T1B183BFB7D20A5D31C189827060E48D793753AAC642AB6DB62AE7C57E8007EDDF408FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900262, "uuid": "693774de-13e1-4690-a8eb-5d28234dcbee", "value": "1536:XaH/2qYNkYZ2SzcCnLhdhMjaNVlJFySSkBw0BWPKvz3eH7OfCt44MCOFbwbZnN:XSe392SzcCLbejITKSh5ASvU7OfkMRtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900262, "uuid": "7e83c966-0470-47a5-990c-4ce6d43d8f79", "value": 84052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900262, "uuid": "3a276c1a-2162-469b-aaf4-53beda286a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900262, "uuid": "6ab35e79-f893-4ece-9ddd-e10a95a59cc0", "value": "3c722860b9cebd228059550a8d1b8ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd995589-0c80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686945864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945864, "uuid": "66ce312f-d095-40f9-a1f0-b084aa0a9ff2", "comment": "Malware payload (RemcosRAT)", "value": "0b6133d5b36cd98c3391f03ae97633d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945864, "uuid": "45d3454c-fbe4-4ae3-bb88-f849930cf51d", "comment": "Malware payload (RemcosRAT)", "value": "d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945864, "uuid": "811fa914-c2db-405b-a921-9815c438eee3", "comment": "Malware payload (RemcosRAT)", "value": "7773a5b7e7780e93cb12b2d12a2baa98b96b1962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945864, "uuid": "e6dcd271-20c0-43bd-83a5-6c4778ec1d88", "comment": "Malware payload (RemcosRAT)", "value": "94d327ad51b9046c88c6c7395e82917c9b8f35d6fa202ff57c34a70aa220872a37ef79f5357fecb939e6b3b7480d9937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945864, "uuid": "fb63df4b-97c9-4620-87a2-c355be6147c7", "value": "T146A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945864, "uuid": "3626d7db-d877-4e92-9160-574449982ebb", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945864, "uuid": "546a627c-d4fb-4144-85be-10efa9a42e6a", "value": "12288:fRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2cDU:fx7cyF2eSsewS8W47eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686945864, "uuid": "bd26b76a-dc52-417e-91dc-39d915b37541", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686945864, "uuid": "efee22c2-607c-4600-bb89-68895fa4b45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945864, "uuid": "76f824fb-1dd2-4ace-9413-3ce193b6313c", "value": "xmawCzphNPzm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3694cb3-0c3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686916561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916561, "uuid": "b045f496-de5a-4a3e-92a4-c3e6a0c58905", "comment": "Malware payload (RedLineStealer)", "value": "69e094c931730a16767c684947bed26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916561, "uuid": "e0d22514-9293-4f11-bf60-7a1294470ace", "comment": "Malware payload (RedLineStealer)", "value": "d52b08e0ba8f58e42fedb287ffe8ec653f7035fc5d9da5e130bb911e09a0d2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916561, "uuid": "8b6b9f98-9704-4caa-9a42-39c68f969e4c", "comment": "Malware payload (RedLineStealer)", "value": "8406fc8ff169ae74474b41f3976386acefb35bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916561, "uuid": "2c1b2663-e0da-4a6d-bce6-d424c2c8d072", "comment": "Malware payload (RedLineStealer)", "value": "ca2049a1a63e1f19c5879df46fb6b5515810219d345aa4dcf5457bc9ba62d76695e51859f401635d826871ac7741d50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916561, "uuid": "8df8be5e-7d55-41e3-95b0-0d0e1ec81f9b", "value": "T10A052242ABC47432ED7A23F069F202971B3ABD968D78935A374A9D4F1C326C05D7172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916561, "uuid": "3589e5b3-e7e5-4a99-8132-a2cfecb17432", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916561, "uuid": "83fd6168-4cb2-4806-9a5e-d9be243b230c", "value": "24576:GyYwWT7WFj2sEFtP6QD6tlRV2ZdpCPuaE+:VY/fWFybX6tln2Zvc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916561, "uuid": "e1d45316-e024-4d78-9990-706d1aa4c92f", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916561, "uuid": "32517338-2a3c-4933-9b3d-4feea8289f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916561, "uuid": "af68277a-c864-4bec-b895-2b0ede30f64f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abce6dd3-0c3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686916951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916951, "uuid": "a8da7fc5-b867-4fd9-8ee9-1b286b3eb0e9", "comment": "Malware payload (AgentTesla)", "value": "d8ea9c772fe5ff50bae8354923c67654", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916951, "uuid": "3cd12f57-160f-4549-b809-0355a1435504", "comment": "Malware payload (AgentTesla)", "value": "d53efc6ad0e0ee4e1c762064af3ef0d624d55940d8920c8482c8d4c77d3221f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916951, "uuid": "31ba8233-99e3-40be-abc9-cfff8dac4f44", "comment": "Malware payload (AgentTesla)", "value": "62cb68e244cc1006c4d97b6ec4e3f9bcdf17badf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916951, "uuid": "fe7b35ce-ef79-4847-a214-19c38e243749", "comment": "Malware payload (AgentTesla)", "value": "1265c291783009e44d5d5eb96b0a87255ffcaeccc3c7244d70266330138a68b29b8b45a8a22ff7f4d6472f984a0e331f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916951, "uuid": "e1eaca84-0545-4bb0-a995-db5a57cd8ebf", "value": "T1D4B17CACBE3A106FB859B16CCB647D0239D8B64A2F3FD866C0201593ECB3C02C594D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916951, "uuid": "8542d1c4-91ec-4ea6-b366-2e919f6f52bc", "value": "96:HGRKTDmWqDxs9TXGbqw2zTb1NFMzqMu8SgfNyEEGqVi7cRLoF/KE6VllLlrllllW:HjqWUxsx22wsmk80iwRLocE6W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916951, "uuid": "1aa9367e-0c15-4566-b9c8-fb26f413bed0", "value": 5338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916951, "uuid": "10d6f795-50cc-4f96-b5c1-29379900be01", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916951, "uuid": "011dd7e7-111c-4f52-ab6a-140770642bb0", "value": "ntransactions_made_through_Santander.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34918d1-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900696, "uuid": "24460e52-e886-4664-ab56-25a074377243", "comment": "Malware payload (Mirai)", "value": "cf5322417a2bb217a302afc1be72e325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900696, "uuid": "c04a3096-829f-4f9e-a0d2-86d1c54d5a21", "comment": "Malware payload (Mirai)", "value": "d568e2e59f8a869cfaaf3b0181c5eb96c77e34f7608358941f14faa577e40c21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900696, "uuid": "0f755f8a-dbcd-41b9-b506-2878d1993ad8", "comment": "Malware payload (Mirai)", "value": "3bf39ad3fe77caa03f9be2d70ab5350dd45ea0f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900696, "uuid": "418431b3-e8a9-4c5c-9385-948602256226", "comment": "Malware payload (Mirai)", "value": "beb10e039e5b68832a0a7ef9e1de3d713e7008fceaa6dbe4f69ba17ad6ab983ed7dd96223a1658490cb613134e910516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900696, "uuid": "eca91e10-c945-427f-abe6-d07e62889de5", "value": "T125733A55BCC19A13C6D113BBFA6E40CD371623A8E2EB7207CD156F11738A86F0EA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900696, "uuid": "5b000e0d-db92-4d4a-a42a-2e4f7d0dc5db", "value": "1536:usO1+BkQ8yi6dT9ncsnxLs9ewNJ4HtGKk/NsAqXLH1iNODui9VAU1vq:usO1akQLq/yz7ViNi/pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900696, "uuid": "1e99994c-cb15-4e4f-9234-293f5c700179", "value": 75860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900696, "uuid": "4d71269b-3a6d-49cc-96c3-cff115c450e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900696, "uuid": "e3982270-8407-4436-aa3e-f61af12d9530", "value": "cf5322417a2bb217a302afc1be72e325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15736fa2-0c5e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686930872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930872, "uuid": "db3557c5-4057-4018-9501-df16f627f08e", "comment": "Malware payload (AgentTesla)", "value": "f3d960b76d76be6d720e97ff408eac3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930872, "uuid": "370b3546-7472-48a0-b54b-d24e201ea0ae", "comment": "Malware payload (AgentTesla)", "value": "d5a8ba6e3442a460c4edef925eced1f1ac00e4a200b82df436c5af9dccd1d7f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930872, "uuid": "f08e94be-a004-4d8a-946a-60bd50cc16e8", "comment": "Malware payload (AgentTesla)", "value": "b4ed10d6cc085f959dc11151e68b94f83a2aeb03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930872, "uuid": "3cbe4a18-45d7-409d-8fa3-7156636df2f4", "comment": "Malware payload (AgentTesla)", "value": "cc5b08dc4f9db7f645edf41e6fdd50cd39802ae4c1125990dad09bab9a9af9691b377e7de9ff8fdfe13da589f42f7f23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930872, "uuid": "fbafa0b5-1ae5-473a-a351-672c164854fc", "value": "T1D905125377E91A21C4114A7A91EB903413F2F69BB2B7DA187BA8C0D40F337C15E4EB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930872, "uuid": "d8d968a5-2f91-49f4-941a-023ff396ecb8", "value": "12288:E/125wkFrqGXRE32i1nZMLVTxiOaBRWS55V1h8+Dd7jN6LJMKxa5uYw07bJFOja7:E/1sNqGXREmEuTxAbWjLxa0R0BF77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686930872, "uuid": "57ce05f2-f59f-42a0-9b31-0838e096c9f3", "value": 872000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686930872, "uuid": "b8b3434c-f0de-4fcc-80e5-5335e4465d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930872, "uuid": "0b4d529a-2019-4aaf-a24f-7f7d32cced50", "value": "99 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63366481-0c8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686949900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949900, "uuid": "8dfcfcb6-c7be-4217-979f-88b434988640", "comment": "Malware payload", "value": "72b601a1609673f221ca537200e6f074", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949900, "uuid": "f11bdf2e-592c-4678-a71c-48221d5a3410", "comment": "Malware payload", "value": "d6d27ed1939b8527bfaab77b5cda589e3cdc842639958f7b4b63aed35ac7a7ab", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949900, "uuid": "a6d79489-ba5d-4a44-b4d2-6b03e99e1ca2", "comment": "Malware payload", "value": "9bd391169223d5d967cbda11e237b68204cb8511", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686949900, "uuid": "074eb29a-803b-4388-b157-5258b2912b49", "comment": "Malware payload", "value": "508eb066bfc014ca9ec663907b87c63f075ee3cd145ccc1b6b475faf465efd69531e992e3f0810e0c1c84333034b8492", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949900, "uuid": "a1412eaa-9cb4-4eab-9219-b574c59808f7", "value": "T1BFB29D09AF7C8E3BC46EDFF948BA6341036A61D5912ADED79EC884E4392B7100615F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949900, "uuid": "13a0864c-f851-4806-be8f-87b85cc720e7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949900, "uuid": "49f3c2b5-1410-400f-b1aa-eaedd03ddd7a", "value": "384:Tesj2NUkxM+lCpLI1jG5DbW0uEhGNvuA8GvLXJhH9bk600rwLAxdL:Csj2QNzcrl1t9bZnwL4dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686949900, "uuid": "8c263f3a-d708-4abe-b8fa-8e5535b96d21", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686949900, "uuid": "d24a4474-2296-43e0-95be-67a6e2519b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686949900, "uuid": "2fed32d2-176e-4a38-a65a-12c377ae5fad", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b61d3-0c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686901717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901717, "uuid": "5ecfa129-3986-4c8e-936f-49e624a96122", "comment": "Malware payload (AgentTesla)", "value": "ada2688229273cf4c6f7a99b754c30bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901717, "uuid": "4f336a55-64a0-4ee4-91b0-852485bcad04", "comment": "Malware payload (AgentTesla)", "value": "d7abd39aef9b875bc280512418843d56e027212adfd34c36d7d20203168b8bad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901717, "uuid": "24113463-80e3-4d34-b7bc-2a8c5532457a", "comment": "Malware payload (AgentTesla)", "value": "3203a1df97391b8724fbb3358dac82612037d2bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901717, "uuid": "1282abab-1ead-40cb-a10b-8706cc61538f", "comment": "Malware payload (AgentTesla)", "value": "2c5dbef6ec853f56aa260accfcea95d7ecf0c36a6699d944b39e7152e8420b5964ed0909e96850da9ddb92c9405168f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901717, "uuid": "1caf656b-2ac3-419c-b305-374ee3790211", "value": "T15D05021022998B1AC47F0BF68855223183776326F533D3170DC7B5F62E92BD256ABB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901717, "uuid": "85688892-e68c-480b-b7ce-9804df369f03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901717, "uuid": "3ed5b224-b883-44f3-858d-8ce791cc105a", "value": "12288:wNWqa2iNx5LbzIu9+r9vd6RYuuWonU2UNKeVy/sxj3PoqCBgl+tjBIjU6kp0ckx8:6a1j5LA9wyLnUDEUVJPoqigwh2Ktk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686901717, "uuid": "0867db2c-8f47-4f2f-a520-3ad42e2acc24", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686901717, "uuid": "6c7eb86c-9acf-461c-bdbd-45031dfab516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901717, "uuid": "eacbd6f7-1d56-41d1-ba68-8c4b1ef1907b", "value": "New Order PO Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4265fb-0c31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686911821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911821, "uuid": "56443128-8f37-4d26-9aec-8ae374d5f439", "comment": "Malware payload (RedLineStealer)", "value": "9ab79d87ba93965164a08e58ee996219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911821, "uuid": "44215ef8-1036-43ab-817f-552cb007b871", "comment": "Malware payload (RedLineStealer)", "value": "d829a24e948e7cb2334ca389814e7bea23cfc55706a35d7d2d83f4f1c12cf040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911821, "uuid": "ecdc1d1f-c23b-4afa-9b5d-c75c7ba99e82", "comment": "Malware payload (RedLineStealer)", "value": "f14f58d2c93a3ac52883fa5087c84f28b80a9a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686911821, "uuid": "f1005baf-65d9-433c-90d7-a6ab31efc31a", "comment": "Malware payload (RedLineStealer)", "value": "b55e113103e6b0c1b31e0376007a2bfbb85d34304be6185d68d3d7aa040b067d6274d5df3b814031f7131026ec46ba29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911821, "uuid": "53a5d0ed-9d28-425e-bfe0-d1abdc58f206", "value": "T17E947C0362E1BD50E9A65B738F2FD6EC761EF290CE5D7769121A9B5F06702B2C123702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911821, "uuid": "0828c8d3-6dec-48a3-b311-3ad54ab638a9", "value": "f9fd3657c1bbe46e7dc76621f74963ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911821, "uuid": "7637f422-1d54-4b2f-8634-b5cb9b757a15", "value": "3072:m00+9wNmDwFqbWLcIOwDzWZ6XrrGP1Im/pPGAhdEc6la6xfOHHBp7VuPZ5SPrZi5:hJ9rDkqCLpAKHZgPxolNwHTg+jYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686911821, "uuid": "bd7cd4a3-ac92-4afa-b229-ea5f82cd7586", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686911821, "uuid": "c210fa41-e78d-4a70-b043-7db69a00e754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686911821, "uuid": "1993fb90-2551-4070-8ba8-30d7aaeb4cfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e56845-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903056, "uuid": "3f7756a7-8b5e-43c4-8d2f-1102b9d57f0d", "comment": "Malware payload (Mirai)", "value": "837f0ed8da92afc2deb1a86e0b139125", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903056, "uuid": "79a5ced2-f8c1-441a-bf78-e5f4f2ec54c4", "comment": "Malware payload (Mirai)", "value": "d91ca75c774c7458eb1956f02be076ecb9c119f596ea93b0b944f373a35eef53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903056, "uuid": "f963406b-5640-4a0a-b77b-50e4705067fd", "comment": "Malware payload (Mirai)", "value": "8ba5c6ad32c6fb5db05a5b2a09cd0a99e303a189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903056, "uuid": "49360235-ef32-4dbe-849b-2c51abfa580f", "comment": "Malware payload (Mirai)", "value": "6768e9476517ae4504436d3e55b48ad56044a57e3105d45d7398aebb12b93cc31f5c4b6e36250b8fce3f883a22177638", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903056, "uuid": "1f4a2f9a-7f9b-467c-baae-287c3beba89a", "value": "T1E6E38536B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903056, "uuid": "542220b6-65f4-4253-b015-8a1a4b6acb8d", "value": "3072:dgZc9h1jlnLA2PiXYeyCccVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZcVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903056, "uuid": "6612d1a2-7da9-40fa-adea-a751e37340dc", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903056, "uuid": "f09881ea-46a6-49cf-9b37-a03ccf014683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903056, "uuid": "bb1a8103-1915-4cad-af2c-4cd8c6aad52c", "value": "837f0ed8da92afc2deb1a86e0b139125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e30a24d-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897600, "uuid": "a6ff15a5-12e8-487b-8fca-78d4f76b176f", "comment": "Malware payload (Mirai)", "value": "84a109662f154a15bbaaa8f12fccfc11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897600, "uuid": "29e5f0ce-11b4-4b2d-ac9a-40dad4531292", "comment": "Malware payload (Mirai)", "value": "da9c942d66b452a3548dc67bf83fcef0a6e5aba12de3c22b29830cedbbc456f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897600, "uuid": "df5292f3-b99d-4a5d-9a3c-070bc554401c", "comment": "Malware payload (Mirai)", "value": "cc258d218f53bd2d431d1e50025c8753366acbab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897600, "uuid": "292c36d5-2e9b-4ae2-9333-35c34a4dc5c0", "comment": "Malware payload (Mirai)", "value": "a38de83792b56df9dfc4a91e0ef16f43c16e0b79dca4e3526357673afe83258ac4ebbc3ceb30dfe060e03f70ce6a188f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897600, "uuid": "89b507fd-90b6-48bf-b8d3-750ef390d140", "value": "T1AC934BDAF4009DBDF84B9A7B44164D0AB53063900FA20F37A3A7BDA3EC731A56D16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897600, "uuid": "c432cfa6-51ff-41be-acc1-bf3f786afa8f", "value": "1536:IY6c16BRRsoBC0ekTZVsmkw35BMZ2zPrIT8BQzvXjTgUA80E7PjzlgLdmBeTBnbV:R6U45nTZVsmkwJCZUPrIlzwUT06YAeTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897600, "uuid": "68b15e17-ac93-4323-b259-98c79ec723d1", "value": 96788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897600, "uuid": "4e912673-fc5e-4a05-8ad5-7a09697632ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897600, "uuid": "64f1a08d-24a0-433c-822c-c99ffb5f56e3", "value": "84a109662f154a15bbaaa8f12fccfc11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15151256-0c5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686929153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929153, "uuid": "6c844226-5e5e-4bc9-9001-e1c25c9a5e9d", "comment": "Malware payload (Smoke Loader)", "value": "f3876e64742070b1644abf61b3c30c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929153, "uuid": "72225d02-b569-40de-9171-fffe791b4b9e", "comment": "Malware payload (Smoke Loader)", "value": "db6a96013bdb32a1b2b0a13f276ce211cccd906e73ec324573c2ed8be69bf2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929153, "uuid": "f4eaf1af-b384-4cd6-a442-350742d07316", "comment": "Malware payload (Smoke Loader)", "value": "30b6c8ccf2be1f27a8b58f4ea9805e48e4859960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686929153, "uuid": "400fa3a3-6bb3-4485-9639-e9777fbc2f7f", "comment": "Malware payload (Smoke Loader)", "value": "03fdcf455b47f8574eeef24d508988109f9edd77809eb3608f1cc330f166c3405fb4d7c1fed8df1e1a23df896b23c805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929153, "uuid": "9ac2a7a2-1500-469a-8ed4-b1929220214f", "value": "T167840913A2B27C51E676CE728E2EC6E8361FF5614F19779E92189B2F04711B2C673321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929153, "uuid": "39bd6d62-3383-485a-9b1e-cea579391262", "value": "2ab0162bfd91ce0b6db4856e4b4f264d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929153, "uuid": "c9438e14-cf73-4179-9f84-cc258f1f50c3", "value": "3072:T31ektC3oiXVelOdb7EpM7fQbFk0KAAwnHNeZfw4ZRKBKeJN7o9rWKl55k9wh5TY:ZRtyXBEOsaweZ4Cu7o/yQBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686929153, "uuid": "a773aa1f-cc97-4e99-8c38-3b22a770ee2c", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686929153, "uuid": "cb0cd732-35ed-4012-b21b-efe98d36ced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686929153, "uuid": "93a140e7-2642-411e-9448-6ef6598d6e62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013c2b0c-0c2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908933, "uuid": "505c42cc-8046-4afd-9267-9caf6c5d1409", "comment": "Malware payload (Gafgyt)", "value": "629c921f169ca65f4b1ddac48b597241", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908933, "uuid": "5f9c742c-342f-4c74-9a3e-06db10e8f5ea", "comment": "Malware payload (Gafgyt)", "value": "db80d2d74cbcb9960c2c59edad0cfbc3009611106c89267e8d477bdd9194d3ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908933, "uuid": "c0c8a0c5-1cb7-4113-8fc6-98f1c1194cee", "comment": "Malware payload (Gafgyt)", "value": "e905d3e9ad0cf2b2843bf8878b36b9676391e8c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908933, "uuid": "696ec3b6-eaff-475c-8b57-3cc3755dbf4f", "comment": "Malware payload (Gafgyt)", "value": "0528a4b786d0fbeb82710c81c5f151bc388b23f1a4cf000aebf7cc954409e83b4de5fd8917d83a64dd0ddfa6efa7e525", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908933, "uuid": "ad2828d5-2c00-4d08-8f25-4da6dfe3aa54", "value": "T1C3C3093B6B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908933, "uuid": "8c82b277-b80e-4430-a45a-41cc55bd8c57", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAqRdc0sfm7ypwYujl3IdnuW:ZP0DNPAT5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908933, "uuid": "980c2514-63f9-4416-beb7-245e6defe7b6", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908933, "uuid": "04b11c1e-4e60-4e59-b6e7-c1a67d613185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908933, "uuid": "53dbcb74-fd56-470d-b9ec-6d409c7fdc83", "value": "629c921f169ca65f4b1ddac48b597241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72afd979-0c6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937041, "uuid": "d8fc4bc4-81d2-48ff-a51f-d67728aa115f", "comment": "Malware payload (Mirai)", "value": "ca982c38393f60d09efb80613e3c37e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937041, "uuid": "e150e503-4ba3-46bc-a108-7ddaedf2ad5a", "comment": "Malware payload (Mirai)", "value": "dbdc1deeb9b07dc88141e30738e17ae670a3e47c9f71ad23de15dc7ac25bf411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937041, "uuid": "32eb48dd-d514-4e02-b4cb-9fb94eb6ac3c", "comment": "Malware payload (Mirai)", "value": "12efa3b4abe6bac19131a96f04e4e30975a4e798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937041, "uuid": "7b89456b-5219-42d1-a223-ce346b7a018f", "comment": "Malware payload (Mirai)", "value": "94f067efa8a478e7c8a2d1b8682201ece4f450eb5193f27eba28efde052cfbde93749291079d5db3b6e581be04f8999d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937041, "uuid": "36faea3b-bc43-40aa-a662-4d0fb95e81c3", "value": "T1A4C2E0E63EB73967DA29003E349DCE365674E062D79BB613E240924C211727CBB718ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937041, "uuid": "bcb57ce4-e592-4c6b-82b1-004b7b4bc8f5", "value": "384:Mn1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QPxYxSNS1OK:CMwoDZLFbBy6HQHRYfeAxdd8CYxSA0N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937041, "uuid": "8f6bf87e-66bd-4d09-8bb8-13176e3e8797", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937041, "uuid": "d2155e65-90de-46f0-bc91-bc2cb24e9f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937041, "uuid": "79b2c4df-b817-44e0-9009-848800c93757", "value": "ca982c38393f60d09efb80613e3c37e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4407fa-0c26-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686907205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907205, "uuid": "aa66b4e7-c1d1-441f-8574-dd4cb4cce2d9", "comment": "Malware payload", "value": "fc7bf4d38953563710c9bf4c8a22a313", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907205, "uuid": "9c33d913-94d8-46a1-ba02-f054c9089103", "comment": "Malware payload", "value": "dc41843c25553d4c3ad3666eadcab424fda983d03f756c9b4830adff4dc0c813", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907205, "uuid": "a23756b9-c7b6-4286-ae5a-b7a17e6c968c", "comment": "Malware payload", "value": "905a719f95e770960376b77ddb3eb567aff9d5dc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907205, "uuid": "d1ed8390-5112-4919-bd6d-8590b49cc319", "comment": "Malware payload", "value": "656f211cf579277faf2ed88902e5d36f5499ab682461d7bdd858880b183ec031bc44bfffcae3704f445140d3cf4538f5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907205, "uuid": "e8293d4f-ce42-4fef-ade9-bff490d95e65", "value": "T114C3AFE0279098E1EB9E9BC3B2696E9C123621BBE9C610CC0185FBD539773519F1DCD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907205, "uuid": "4b478879-4373-4dbe-964a-cb6e1dc02549", "value": "1536:ohGiGrPOD/1rW6RsiKENLMhjZdPPNU/+WtROTCT9LmYbzGtyw+PIpPSO60/RQQxi:BV60GCYbzGdpCQR9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907205, "uuid": "72e9cdc1-2ab2-420d-acfa-afa84e18487c", "value": 118443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907205, "uuid": "aede7422-1ccd-4528-a14b-480e86984a25", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907205, "uuid": "6ba427f1-dd3e-41e3-a3db-82c7fbff8235", "value": "PO-4501226854_WJO-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f61e152-0c52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686925734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925734, "uuid": "4da45c8a-ee18-4f68-89e8-71c772013cd8", "comment": "Malware payload (Mirai)", "value": "ea318f8569dbd7e3cd8ed69fba2e27d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925734, "uuid": "8f37a837-5c69-4c6d-9d5d-9248349a2d74", "comment": "Malware payload (Mirai)", "value": "dda591abb31b69149b3e8228a9f345153ccca427b6d60d4a07d4027d388d2d4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925734, "uuid": "90165a38-7a09-4c9b-93a1-2fee2a0daab2", "comment": "Malware payload (Mirai)", "value": "62db45b572a6bf00a805e26337eee0a5422184b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925734, "uuid": "d38d4876-c385-4078-bbb6-2ab92b5c433d", "comment": "Malware payload (Mirai)", "value": "3f46146200360705e07acae8f84b1ffb5e92a62543276587e4118a9676a21011ae4f9e6427dc30d4696fa24548254d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925734, "uuid": "abd3e430-7ef4-4f7c-a644-9e754c6db496", "value": "T1FE834BDAF9019D7CF84BD67A44660D0AB530B2D01BA30B3B63A7BD73EC321A56C16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925734, "uuid": "fe3a0a3c-a870-4c11-90c5-7eac9a48fa62", "value": "1536:8sS2zcck+P3eAoi+Y2GJuwAtvwd87KIxxTnd8YnrrcN76deTBnbf:q+P3eAozY2WPAtvwTmnOqldeTBnbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925734, "uuid": "0cf69281-8de3-4e2f-ae15-a658917db1ed", "value": 82968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925734, "uuid": "b127c436-1e4f-4d37-8d95-8173730aab1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925734, "uuid": "95e48663-a120-4659-80e9-22f6a67f199c", "value": "ea318f8569dbd7e3cd8ed69fba2e27d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a2b6be-0c35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1686913417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913417, "uuid": "02c34325-2fb2-4e86-a2bb-304df1a4f824", "comment": "Malware payload (PrivateLoader)", "value": "77d9f58d8f63c0e6b009a3d21720cc4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913417, "uuid": "17e6b823-f9d5-4b76-93a6-c9f0f0579b50", "comment": "Malware payload (PrivateLoader)", "value": "de4f1d5b2d7f64aa3006596f46aed8c200e74cfd15100af9181201ef66346c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913417, "uuid": "978b8f49-6ade-47ad-aebf-ce68045b17b1", "comment": "Malware payload (PrivateLoader)", "value": "28772b7c1276573877b111627d8388765a157de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913417, "uuid": "55d55c58-bdc2-4cf4-85db-27a16e4c53b6", "comment": "Malware payload (PrivateLoader)", "value": "d191b9417c94c43a4a62f452d3984e7ddf222bd458b75230712350ecc433a22643b3c330b9467415f52f98a88f8bac79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913417, "uuid": "a1e959fe-8942-4b6b-90a7-486a18405ef2", "value": "T12A25BF11E30390B3DC620474118ABFB58AB9393041B699FBEBE01D699D3B7C1A36579F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913417, "uuid": "2c0cf23a-8ce4-404d-b163-693d8f2a2939", "value": "502e8f4d81140058255715c1a60956a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913417, "uuid": "87c34ee7-13a7-4b4e-a5e9-e041f01bc015", "value": "24576:9xHqHBQl/qp++A6L74wF9z7oPqpHKhbxG8oZsIpDJsTRky+:9EO/qp+/6Ls09WbuJsTP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913417, "uuid": "a9a96e6b-d37f-4829-90e0-81d8857e499d", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913417, "uuid": "f43f841a-7266-43b3-bf51-22cbe1a2b071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913417, "uuid": "535a25b3-7ccc-4a87-9575-af769a8851f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bfb17c-0c4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686923093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923093, "uuid": "2f05e085-6154-4a6d-a021-988eef9afd90", "comment": "Malware payload (AveMariaRAT)", "value": "10cd284660133c5f8f33cc4cccc0f34f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923093, "uuid": "9abb64ee-f44d-434f-89b8-86da1a48ce66", "comment": "Malware payload (AveMariaRAT)", "value": "de716a5e98013894445471b78da71e1a68739adb4573ec3e4d01c110ee41b957", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923093, "uuid": "cf9fbbeb-0102-4785-99e3-f0ea4e6dc6d6", "comment": "Malware payload (AveMariaRAT)", "value": "5baa5806ea5b7eb7da3d7b89910f48922da579b9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686923093, "uuid": "130338b5-e4c9-417a-9fb7-2c1f7f6e7ca5", "comment": "Malware payload (AveMariaRAT)", "value": "a0f5f31b4431841d7c7ea6975b041137f7ce7457ecd1cf82de6e7e308096fd7b00de160e899e114ede2bf0ef45f60928", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923093, "uuid": "b51ac69e-28b4-4e27-b467-448941d89478", "value": "T11683AFBCB5187CE2666E565BD996ADED13B23633DAC798CC807876C305B3326DE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923093, "uuid": "93b6044e-7969-462a-b9ec-2db7a018fad4", "value": "1536:sZMVZ0XrRo57uHQOuiI838wahKC+UBcGJBxWnj+xU2HXDGPqtVkuE5gcM/:sZoZ0Xa7uwv8sVhKC+DABxWnj+xbHXmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686923093, "uuid": "7d9a3960-f56f-467a-a41c-72beddfd3bf3", "value": 84812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686923093, "uuid": "72640e30-f5bf-4063-8292-5e1cfcee183d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686923093, "uuid": "388735ac-fb02-4880-8551-b71335cf1d77", "value": "PO No 4000302979.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e919d8d0-0c2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908893, "uuid": "ce0e291e-e195-4bf4-95ec-13c304b8f1e5", "comment": "Malware payload (Gafgyt)", "value": "0120e191a3f837ff6d0d32d721cf454a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908893, "uuid": "0a158df6-166a-4464-bdcf-2b172d83ba37", "comment": "Malware payload (Gafgyt)", "value": "dec33276a2aacaff1fb32f85b39e9913b56687d1d06b2462f48a74151565fa38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908893, "uuid": "bd7128a3-d477-483b-9d72-c2d6ab279a9e", "comment": "Malware payload (Gafgyt)", "value": "0663b0f4a9583cdfdf36e54aca1c46e30ae4acdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908893, "uuid": "fc9c51eb-b693-48df-b344-6f0601dcd3e5", "comment": "Malware payload (Gafgyt)", "value": "e0e3ab2545df8a127a408c6befa993c4134efdb3ee9811d9d2ba8312acd5fbd7f07955148ef1532c8b1c87fce8866f2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908893, "uuid": "a88d9575-9dee-4382-b3ab-baa3d4f8be30", "value": "T153E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908893, "uuid": "bcccd713-f008-4f8c-8931-96c8d8140ac2", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVKpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflYgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908893, "uuid": "ad15cb23-7a6c-4dd5-a56a-c3fbf8d7cdaf", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908893, "uuid": "d5287b89-bd11-4b6a-8b28-e10442d642f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908893, "uuid": "63a69af6-45ae-4c74-be98-34139c7108c7", "value": "0120e191a3f837ff6d0d32d721cf454a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fbf865-0c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686901719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901719, "uuid": "e6558675-94da-4c3d-84fc-a42581423b88", "comment": "Malware payload (RemcosRAT)", "value": "b620202fd948bf4a19382febb01f0e46", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901719, "uuid": "c672c570-ddee-4306-b869-c441ef6788fa", "comment": "Malware payload (RemcosRAT)", "value": "dee59547613a92e1b546e682d11a8b575dad122d388676f49d69fb2dcd1ca2fc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901719, "uuid": "51607b45-86d8-481d-8fa4-f1edbaa6ba06", "comment": "Malware payload (RemcosRAT)", "value": "fab67cbb69c0ec8d93007634b8cf39529afe45bf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686901719, "uuid": "f39aff09-cf6c-4181-b262-ee30efc30f3b", "comment": "Malware payload (RemcosRAT)", "value": "abd7f612ac301affec1853a87042f93e03254bc722d820ef24aa3c138659d2983d6baaef16e28e6437847d5db955c740", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901719, "uuid": "df949f9e-c063-4add-9356-00e5f62e81ef", "value": "T1AFB4239F4B4E7B1E2925C8AF021D468BCE019CD644E58F76929BF3E3264CDC764A3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901719, "uuid": "5099069c-a461-4be5-8d62-0bae10bd2d9e", "value": "12288:/SJQIwwWgzLZS/YJ5mL61R3zLdt931VbvNKOlZpBEm:PI/Wg/R5v1R3PpbnlZvEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686901719, "uuid": "c3a73428-9df8-4b31-a6f1-55c34b80e20a", "value": 522678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686901719, "uuid": "9c1011f7-5369-4289-9b0d-bfbe2dba06fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686901719, "uuid": "3edf3728-d440-40a1-8013-aed8569d9e6d", "value": "NEW ORDER & SAMPLES_1.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fa570e-0c81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686945876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945876, "uuid": "76da693a-26b6-4041-b1ab-7a4e723b7229", "comment": "Malware payload (Amadey)", "value": "49bdb23147b154b40bba66ffa7dfe57e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945876, "uuid": "42af94e5-43d4-4c4b-8dac-1a1de388378d", "comment": "Malware payload (Amadey)", "value": "defc8629ec568833c618b6fe81ac45ff7908bb553b2811850a2e7f2e60b446b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945876, "uuid": "03cb7c8e-1642-46d1-9c60-1bd05f9a9024", "comment": "Malware payload (Amadey)", "value": "af9d980ca5dcd3b4461b583acea8da01ecbbbe8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945876, "uuid": "623b3c55-4fcb-4924-b07b-0e08a12b7ad5", "comment": "Malware payload (Amadey)", "value": "291e341c23916602459117ecb04d67beaa3709697a8d7303dd60a893b8e9623505cd36e2ab9b4c2d7ef32baa0c9918e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945876, "uuid": "56264c91-9b53-4a0b-9082-ce9a3cccd18a", "value": "T101052397BBD801B3D8B55B7028F617D70B757CB21E6413272B855D1A1CB2AA0AC3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945876, "uuid": "dee9366b-23f9-49e3-bebb-70a2c0b67ec0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945876, "uuid": "9cfe830f-5983-49dd-a435-8604a4d1ad57", "value": "24576:oynOXd0MLc/4PdkrBn7ZgZwbqDu/gWOXP/kvn44rxEW:vnad0wcwkrrgKqpf/k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686945876, "uuid": "5f4fbc26-23ee-4b75-b747-09303cf3de32", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686945876, "uuid": "6a15bcaf-9835-4b8f-b73c-6476476abd41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945876, "uuid": "118397d4-687b-4f31-9059-b219a0e471ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa07ffb-0c50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686925189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925189, "uuid": "a45d053b-f985-46f9-ad63-00604106c725", "comment": "Malware payload (AsyncRAT)", "value": "81e7f516f000360070fcabddaa843975", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925189, "uuid": "0f817728-5c4a-4466-897a-68651d008014", "comment": "Malware payload (AsyncRAT)", "value": "df7a8962331cc5a23cd13744420aa91547cfc085950d22ab1b7e4f298b2ee0ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925189, "uuid": "d2a677af-3cc8-4b66-ba56-1e94b4609180", "comment": "Malware payload (AsyncRAT)", "value": "75133bc960f4536afdc3c019664903541f7d7c7f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925189, "uuid": "e493932c-39a1-4275-aa65-e47e29e0bd6e", "comment": "Malware payload (AsyncRAT)", "value": "d2e7259ff737b7af1c8e3a44234c27b7856f808cf3ac0c45dfbf4ebbd05d9b294d98ecfa9171919c55fab99ff0a597c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925189, "uuid": "ac46d887-40d3-4396-9aa5-52e5eccb120d", "value": "T1A8235D0037A8C136E2FD4BB4A9F392048675D6676903CA597CC864EA2B53FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925189, "uuid": "1b253153-a752-48c7-8de1-2fd54c54bcf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925189, "uuid": "a2c2c114-ff0e-4364-8187-b98d2886bc4b", "value": "768:gq+s3pUtDILNCCa+Di029oui41Ybage+buiKvEgK/JHZVc6KN:gq+AGtQOx9VubNcPnkJHZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925189, "uuid": "9b784b13-9f58-4fc6-af9b-53b14470e76a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925189, "uuid": "4fbbd276-0c3c-4ce3-8c7b-b78ad3e84a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925189, "uuid": "cbf1083e-ac16-47de-a496-154d00684b29", "value": "xIsLPxI68jk0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784d8738-0c3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686915576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915576, "uuid": "d9b98fb3-876a-4eb8-979c-222469206ada", "comment": "Malware payload (Quakbot)", "value": "7d14c1ea93ed4a0f7ac909e5ff4d4d3f", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915576, "uuid": "209e656c-09de-47f9-b113-4f005d86afde", "comment": "Malware payload (Quakbot)", "value": "e03700e31e59c8e28fdc160e08521728028f5b28c8277879c17660c9d828d702", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915576, "uuid": "a73f89d2-a63d-4b6c-94d6-b268d84df30a", "comment": "Malware payload (Quakbot)", "value": "36d33845bf50bb1ee1614810b0649249845af2e1", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915576, "uuid": "37bf2455-c171-4d48-846b-9f4cd0027435", "comment": "Malware payload (Quakbot)", "value": "231dab177c1397e825760b40106e3d68d676869b4c89a0790662438697a68ab6b1442982fa917961ad738e4bc89e22bb", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915576, "uuid": "d2bc7867-e9a7-4d22-b24a-517a6c33920c", "value": "T1C8D4A405A78955B4C0B7B33FDE5A8444FD391A2F2452896F7A3C91EC0F3982462B5FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915576, "uuid": "c8108b13-7a41-46c4-8e02-dbd2da944c72", "value": "12288:yWGJKxqUwYJpnwhdIhiZAwIQ4Cj8kA4dywL0u+p+fm3DB29vRQIXQrQHRtzggojx:yuZ9KCkHR5ggoo5vuDf2Ag//nt0n4GrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686915576, "uuid": "fd4bd3b6-722c-41a0-88fc-90b64152fdda", "value": 609585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686915576, "uuid": "08522cc8-63b8-4643-9fac-ae59eb8731c5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915576, "uuid": "9f76627f-eb49-46f7-9c27-9f95ab88dd5a", "value": "j5AjJbaUhZxlb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9d2530-0c44-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686919829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919829, "uuid": "8f5d2f8f-5053-4b7a-9e60-d712e6013542", "comment": "Malware payload (AgentTesla)", "value": "e1197a51323132b2e1e122d1bfac128a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919829, "uuid": "e2129b85-fa17-40bd-83b7-8260c3637995", "comment": "Malware payload (AgentTesla)", "value": "e0a29823a3fe90f38b1c3158b648f919e42a3d034428bfae8350fed27bd3a170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919829, "uuid": "57841db7-1555-49b3-b912-091e27e5c5b8", "comment": "Malware payload (AgentTesla)", "value": "b075ae2ecd30f9716911c707e2dbdcc261c9735e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919829, "uuid": "497daa02-51f9-494e-8acb-e8bee16b20d2", "comment": "Malware payload (AgentTesla)", "value": "1963574fb32021e488f7a8244236add275517c13300256320b9da4ef3a73f7130e815d2616c12d5577ee81c6863559b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919829, "uuid": "9eb03183-6a72-4367-92ce-2d15a3b3348a", "value": "T13F549E993251768EC82BC83989E60C64A6A2766B1337D247744F12DD8F0E6CBCF157F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919829, "uuid": "b0ff0d8b-b09c-406e-8299-74c54ac878b5", "value": "6144:J03mjlC3YAM2xfSu0Wz66L7D9gL1tBBcQdH69nhaOq:C3Z3YT2FSuPz66LW1BcQdaDab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686919829, "uuid": "5f2fb783-f286-437b-b0e8-29a5b271c383", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686919829, "uuid": "f4e66a42-d9ba-4871-89df-8af8ff9ea500", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919829, "uuid": "7938312f-1e49-49c0-b5bf-98106e6cbff6", "value": "nYeni sipari%15F _.Cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b1a004-0c7f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686945047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945047, "uuid": "722a3ea8-8443-4293-98a3-5f1b3bd7437c", "comment": "Malware payload (Rhadamanthys)", "value": "e6509da0cd782a0f38fd69a1b2e9e916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945047, "uuid": "de95b4eb-ff7b-419a-a078-766792801192", "comment": "Malware payload (Rhadamanthys)", "value": "e0a50fbd358e7561e1017edd90a51682f345f6fe8248aa1bf352411ce57d54e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945047, "uuid": "f2851675-3b1c-4254-80cf-91a2baa5c754", "comment": "Malware payload (Rhadamanthys)", "value": "8f92b953152a76f72da265e5435ad7b25dab604c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686945047, "uuid": "75297750-e4b1-460b-8dea-3af0229c1252", "comment": "Malware payload (Rhadamanthys)", "value": "faa76c6e2e696a0f1ee328b1ae75167c0a15a5161b47156a5e522b45d87a3facc0a09f78746722e18bc9724ea9f98c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945047, "uuid": "d2f043c8-3e23-473d-9fb1-6dbfdb1a7c31", "value": "T1DAB47C43E2F27D44EA36CF729E2E92E8361FF6518E49776D61189B2B04B10B2C563721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945047, "uuid": "f947e344-ff7e-4b7d-8e2b-9ffd156f1320", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945047, "uuid": "12374343-4b4b-4035-82b2-4efd8a0cef54", "value": "6144:z4NPhBv5aN4X13c7fQGGnb9YQVrAvxJtz9dZvaBdC00emALRnB:z4NPh95QuFfbSa2z7dZvOdP0efLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686945047, "uuid": "58264215-2e67-4699-b197-7fe4bd2dc52d", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686945047, "uuid": "e23b1e43-b26e-4ee6-ad33-d18611646d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686945047, "uuid": "df377315-8d9e-4eeb-b2f8-e28469a070c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005b6901-0c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686894759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "888d4903-6bcd-421b-8e15-bf02f55cbefd", "comment": "Malware payload (Formbook)", "value": "17fd0df7c412cf4e54e230e3b67454b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "ac081c61-b151-447b-91dd-25112a52aec8", "comment": "Malware payload (Formbook)", "value": "e43e5c816ce04f8fa14c819ff2b5bfc02c03e27a4b0a6b85875ef11ea4d4489f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "533b33bd-0ed9-4a3e-80b0-344f66daab50", "comment": "Malware payload (Formbook)", "value": "7adad4296ad7408c0ab2dd481aa71a5addf10562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894759, "uuid": "34f41d40-2405-4983-9aaa-04163f885bdb", "comment": "Malware payload (Formbook)", "value": "7c12be5786ab3dedfbeaff3000995847bc0b05574f48080b6317c951b9d932a7d0ee80cb9755e670d1435735f9f560be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "db0dfc89-2f3c-46cf-af02-91bb2d8a1ccc", "value": "T1CE036D04BBEC4362D5AD477D9431221043B6BAB77323E3195FD3A4E92A723948A51BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "7a5f2231-8039-42b8-b3bb-6afde2aa42a7", "value": "768:b/IVNMJibIE5fIbFe8i+ndSUcEslQU/XSpP+P4:kVHIbMb0dGELqXSpmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894759, "uuid": "9285c222-9424-4a95-8edb-6c0b8bb093d7", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894759, "uuid": "10846956-65f3-4124-b3b8-f262dc0daa0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894759, "uuid": "f3769f39-0163-43b5-9b93-8e17c89aeb5e", "value": "Ambiente Frankfurt TOMORROW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43869ff2-0c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897878, "uuid": "6f1e8109-52ba-43c1-bf02-d4b5eef1f75b", "comment": "Malware payload (Mirai)", "value": "d4ae5373d6f83ecc45a982968ff7f178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897878, "uuid": "516875c1-7e05-4f8e-997d-49c3ce575128", "comment": "Malware payload (Mirai)", "value": "e4fe993ed1e1b134c7f95edbca4b4a420fe8555dfa54fa992970e2d38220c166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897878, "uuid": "d5a5b63b-b2bf-4fe8-be05-820d4f37d02a", "comment": "Malware payload (Mirai)", "value": "c7879f293221d5b4e81da44159532a24536688d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897878, "uuid": "8fa842ea-a90b-4eb9-89d1-a6abf7fb4bfd", "comment": "Malware payload (Mirai)", "value": "e0f8e8e4708f9d4213bef0ef6cb25b476152b977ff57c22f632eb6f3634fa751fd0fdfeac62120504b8238fde3c35153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897878, "uuid": "b0f9e6a4-35cd-47df-8be3-d52597ca4577", "value": "T190A2E059BF2C85CBC836293555E9EAD21292FC72F3DCDC492540C16FB4A32A92470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897878, "uuid": "aefa9d16-df4e-45c0-8601-46d49774cd88", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKJ:x98o08kxofBE+ZkXaqGbp2F2TWul0c5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897878, "uuid": "49707b54-1c1a-4602-a642-8535a1fb5cb8", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897878, "uuid": "e9d734d7-ea4d-42c1-94c1-71ca14fff12d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897878, "uuid": "7f5fa13e-00e0-40e6-abfb-be4475529255", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80fd830-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900677, "uuid": "7a0e7bac-96e5-401a-9a85-d6426779f913", "comment": "Malware payload (Mirai)", "value": "f53701fecebe32de51af85a3ac4fc5f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900677, "uuid": "25c7172a-8a20-4cb0-9d60-3a8bab891208", "comment": "Malware payload (Mirai)", "value": "e58f883f260bc16032292d9c012b537e3f8d6a957048c639748055f946923d9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900677, "uuid": "0c8e2a57-56d1-46b7-8cf7-ecd6c79f6111", "comment": "Malware payload (Mirai)", "value": "db740b8ae89c841a84b81e140e966056e3fd4a3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900677, "uuid": "2b0e197c-4668-40fd-8c5b-68e5de06032d", "comment": "Malware payload (Mirai)", "value": "9e30bc5bae8e48259f54b5586aee514bd0d2640e7aeb733bca81a69d0af98b250ae4ba2e650b778fb30a6ad07f3e61a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900677, "uuid": "fa60863d-48b6-4358-bfb8-be2d705b4ec2", "value": "T11982CF3051AB74E8DBF14431FEAECEC697160BB8D0FC36A217596B78894550621F92C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900677, "uuid": "3e48e3e3-483c-4404-919a-00da72005e26", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaGuhymdGUop5h5lo:6GV0P6+kom0tVAoNvm+to1Gus3Uoznlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900677, "uuid": "b1592289-aaf3-4ff1-a82b-d2c197fbb3e2", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900677, "uuid": "ac2c7a7b-019d-476d-84b2-31fa54968ffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900677, "uuid": "046aedc8-d85e-4762-af33-41a23bf02e15", "value": "f53701fecebe32de51af85a3ac4fc5f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee504a58-0c3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686915774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915774, "uuid": "d66ff8ea-ec8e-4036-8a3d-b00dfaff223d", "comment": "Malware payload (AgentTesla)", "value": "cb5a7915188c9e75ef138d1a5e363e82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915774, "uuid": "140f4eee-0d6b-469e-8efb-6635399647bd", "comment": "Malware payload (AgentTesla)", "value": "e74a3533aa90e8383320293557cf046058127acc645c9ff6c53a336c9967b5eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915774, "uuid": "f8f935a2-e0c4-4fcf-8d5f-8d7702d9ab4b", "comment": "Malware payload (AgentTesla)", "value": "905314d60a38d65876c1148b12a9824917f8b8b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915774, "uuid": "f29f53c8-60cd-4759-a987-0fad63483e2e", "comment": "Malware payload (AgentTesla)", "value": "bfe9d0af9335e5f0118effcd6754c3b056aa2fc7850c42b940f71750c5004a220c8a5ec7c600266a940e99fd2d8a6755", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915774, "uuid": "f56eeea0-a409-4138-bc06-b916455cc841", "value": "T1B2F4127D1BB3965ACC827FFC0C512AB6E0F95A95343AD6074FA7EC8CDC11A980D816D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915774, "uuid": "20204ae7-de91-4de1-a15d-016040ac29b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915774, "uuid": "eb77ddeb-f7f2-4bac-b548-dfe2a8402d52", "value": "12288:HRPWR28Le0cY+Yg9fb9iywiaA3AW9un7wp9K0oLarvkyDAX+VB3OMfrQ+PbhcXLL:HV+xL9Rk9Eywicnv0oLa7kBX+VBVrnWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686915774, "uuid": "44d5f7f7-5acb-46ba-bdbf-8d2efad0639b", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686915774, "uuid": "4247e55b-9bb4-4ee4-9a65-e141d4ffbf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915774, "uuid": "307b6af4-d22d-4ee7-9620-4d0594eb35b0", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9551ae0-0c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686919577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919577, "uuid": "246e8382-8ec9-4708-aa6d-a957b7ec16bf", "comment": "Malware payload (AgentTesla)", "value": "0563a77e01a277fb093c38d22976baf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919577, "uuid": "477225e6-bcb7-4eb3-a7bb-8cafbda8f685", "comment": "Malware payload (AgentTesla)", "value": "e77034ca0f5612915367f7d97ba20d7452594622ce20078eee74df276173ef47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919577, "uuid": "ef689158-ce28-4c80-93bd-0fe857ad18f7", "comment": "Malware payload (AgentTesla)", "value": "598d7e138b9a89622b577dac8af399c37d929254", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686919577, "uuid": "d6f77731-55ad-4455-afe2-d0ffcfefcd39", "comment": "Malware payload (AgentTesla)", "value": "ec6f852f38a78bc3239b371ba755a7df4e1a945584f1c1ffe18f382e1a44ef101234cc2d56fd4517764ff64c36ce116e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919577, "uuid": "31ff316f-b2a5-4568-ae5c-d1baa8f7650d", "value": "T17C050244E6E9871AD9FF53F895A055304BB2B85B7877E31E1E82B0E56E22B114F02F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919577, "uuid": "708f6fee-9c0f-4b08-8864-056cab04ba7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919577, "uuid": "9b7cdcef-4ff0-4862-bab0-97097bbc4162", "value": "24576:0+x4VDw0WgolFIfXlNnsLmO+II5U4qXdVk:Zx4VDrClFIfjsLmO+ICU4qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686919577, "uuid": "1aac023f-6f40-44dc-9184-5428ac738384", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686919577, "uuid": "3184d7fb-1c52-4668-86c1-7109fea81276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686919577, "uuid": "038bc0ac-228b-4fc7-bc1f-f4c70db063bd", "value": "DBS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037fe7b2-0c2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686908937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908937, "uuid": "08641da6-c0e7-426e-b2a7-b51f7276de21", "comment": "Malware payload (Gafgyt)", "value": "42443856f945c31370a423d3f0613614", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908937, "uuid": "a1fbf0d8-70d0-471d-a92d-2e2cc772dc60", "comment": "Malware payload (Gafgyt)", "value": "e77305aaa1643df3865279b835988ed270fc5de9b7a5226cda26ebaa17deb5bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908937, "uuid": "1473fe67-df5b-42d9-a43b-a8bd68f8904b", "comment": "Malware payload (Gafgyt)", "value": "bda57ba2b2e6d8fc5bab08c746f1530819d48d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686908937, "uuid": "ada4541b-445f-49e2-81b4-91ab0d8e394b", "comment": "Malware payload (Gafgyt)", "value": "903f48515edaba10e3111ac96449e588faf84a0fa705c40a5a2780b0b7f4abb044424be5340b52fbf7d11963e63be275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908937, "uuid": "3ed894bd-1614-427b-be4f-da436b53b7ef", "value": "T1D8B31792F900DFF6F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908937, "uuid": "899b20dd-ad4f-4bdc-844d-398ffae02ea9", "value": "3072:DG+3MNBCpCTyRQpimmrytK0s4OWlKhRm2pgYMx3IPtW:DHCTyRQuyt5seuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686908937, "uuid": "e4fb141f-2b36-4d5a-9bea-e45b2a5fed19", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686908937, "uuid": "2f2ee9e4-2cf4-4eb0-90fa-a7ae3063243c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686908937, "uuid": "7a2de69c-5d31-4262-9e92-fcf72797f2d7", "value": "42443856f945c31370a423d3f0613614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323dca30-0c0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686895272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895272, "uuid": "96670511-79b4-4fd8-befd-8fabe2a6a07b", "comment": "Malware payload (Mirai)", "value": "fa6500147464d1e0667b93033c9d5aff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895272, "uuid": "b0ac8317-d15d-4d9c-a05e-4000f8783264", "comment": "Malware payload (Mirai)", "value": "e81bbd74afd9d9325bd2431a38bae64688a049b3ac6c1c1fde4525eef566740a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895272, "uuid": "c12f6092-0af2-45cd-8ea2-70baa6fab941", "comment": "Malware payload (Mirai)", "value": "6db3191b4dc71c4427a989e884e7e0375ef27472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895272, "uuid": "aafbc113-7b77-4d2d-9a71-16b6af98e927", "comment": "Malware payload (Mirai)", "value": "4660630405b8b2e354ab5d741deda9ba278677c5389c0199417c04badd3a6545c3e74756522c35e0ac872695ac84f73b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895272, "uuid": "047077c1-5dc3-43e3-8625-4f3303c8276a", "value": "T15F23F94AFD41AF01E8E521B9FF4E114A33535B6CE3FE72129E252B25678A91B0F76801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895272, "uuid": "d0f80888-d3a2-47bc-9f56-5ae525350d51", "value": "768:IpnX6SYwWi8os83taP1ZVT+JoPDelgykbHim71Dy0tCMqKKp8hCMe:Ipnqd4JYZVT+JobelgyqHi812JcAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686895272, "uuid": "a9c4301d-414b-4a72-903c-8287e6578ee4", "value": 46608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686895272, "uuid": "6a75ff03-c5b7-49bd-8ffc-dfa05f42cf00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895272, "uuid": "48b353f3-ff10-46a9-8332-bfa1e89515ba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb25f33-0c95-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686954511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954511, "uuid": "936c2b64-3af4-41a2-9458-d1261cce119a", "comment": "Malware payload", "value": "f22a5983af3ce0b2954fcb55e7791fa1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954511, "uuid": "4706296f-1507-4b26-9a16-64d376943dd3", "comment": "Malware payload", "value": "e8238216368e10569e0eadda6a99e352517340f60e661b9f875e0cba995e2cb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954511, "uuid": "33928438-5c01-4629-8c52-d93dae3da731", "comment": "Malware payload", "value": "435294534e8a3658b6501ffcb6491b4e06c33223", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954511, "uuid": "0e2b334c-7de8-421e-91b9-e1bd09d91f1a", "comment": "Malware payload", "value": "ba5e33a789c9e3fc683dff9491879e3a51dbb56e5c8bfe2717604975fd0224ff6a5e2044746cef0ed1088f8b21ce46e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954511, "uuid": "428a5041-5733-4734-9d44-98f3a9fd10e0", "value": "T19F8533A09978DC3BFF99463C59B616A794B8B2079737823E46801DC3CB93C77276C522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954511, "uuid": "984efb41-399e-4a49-b630-c8087dcfcec2", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954511, "uuid": "fa99cdff-9bca-4aeb-becb-d42a7c58c137", "value": "49152:zfggeQsAsriam1d8HGToaiJsbvZXlrBeg/8efVa/thV74j2:TheQrsrvm1GIoaF7ZVvkLhV8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686954511, "uuid": "718a9121-013d-4fcd-a7af-ad65f113edb4", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686954511, "uuid": "6fbd6a67-93f0-4cbd-a1f4-36275592a655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954511, "uuid": "31815cd5-ea48-4ec0-991f-6ba9c0f6cab5", "value": "SecuriteInfo.com.Trojan.GenericKD.67529571.22240.4548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb483a6-0bea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686881116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881116, "uuid": "3dd046e4-3e10-4f10-bfc6-fbd54bde45f9", "comment": "Malware payload (Loki)", "value": "c01f281052c2455c4736871be5731f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881116, "uuid": "6fbda697-869c-45c1-95f7-b3498cb31dee", "comment": "Malware payload (Loki)", "value": "e9104c6f82a1b8c52bb881161440b8b1a8e3bf358cd60672dbfc14a2bc12518d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881116, "uuid": "261267af-9fa6-406e-b14e-aa638616f1e0", "comment": "Malware payload (Loki)", "value": "3ca2317d83934b544c1e39fea751dd8beaebaf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686881116, "uuid": "0e1ad2e0-61a6-464c-b4dc-d6fb6bf9beb3", "comment": "Malware payload (Loki)", "value": "2d70a3743545cc36dede0a52875e903236432c13c702ab1cbea9b78ffd75f75f524f9d6a5c049d3cf38827e178f46ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881116, "uuid": "66517e9d-2cd2-4aad-8bca-ddb2a87b5cdf", "value": "T10DF4021062A4CB1AC43F0BF64A502130877B6327F527E7171DC2B5F92E62BC2556FA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881116, "uuid": "81dc699d-519b-405d-8b94-0f908d0d4abc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881116, "uuid": "d4e76b26-1a50-4d21-9098-bf8aad3a0f14", "value": "12288:FNHba2iNx5LbzIu9+r9Bc62w/7XwNrjpnpw5xXOWonUDGi9rLThUEh:3a1j5LA9BZXArjcOWAg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686881116, "uuid": "d650eef1-d002-4298-a379-b05953d54097", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686881116, "uuid": "be79709d-c535-4aa6-b658-82e586de02f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686881116, "uuid": "b93b9d47-8004-4aef-b2c2-9fef44c7fb9b", "value": "c01f281052c2455c4736871be5731f8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3f9db4-0c16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900286, "uuid": "9014fa7e-aaec-4f7d-baf6-7ec2ef7a1443", "comment": "Malware payload (Mirai)", "value": "ea183a01d9380baeeb7ad8aba542b3d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900286, "uuid": "fb999ca0-6b11-4eba-8434-8feb69030d84", "comment": "Malware payload (Mirai)", "value": "e97691a8bbc942457958e7a1b74ec52c393b90525e9111eac68f2d9e326cb5b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900286, "uuid": "2e588026-91ab-4ed7-982d-ebdee15bcde7", "comment": "Malware payload (Mirai)", "value": "2b686c8becbe14b9fd5c748631d0af2cdfb880e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900286, "uuid": "aee9b08e-bd38-413e-884c-003602274ad8", "comment": "Malware payload (Mirai)", "value": "fcfc668f18cb9ace2b2ee92ae79f8a99b5bf5c52cb11f9cf58ec002819eecf9b99312be5ffae121b06f1494886a341f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900286, "uuid": "d67c0354-340b-4e39-b4b1-69c41ab203d2", "value": "T16C330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900286, "uuid": "a523718f-c4de-460b-9274-6e727a573237", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGK:r/hqaJMcjeqK806MHdMfQXoHuCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900286, "uuid": "3c1daf94-af90-4072-a0b7-ebcbe243020a", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900286, "uuid": "f916d45b-cdba-4887-9155-bc5c1cba9fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900286, "uuid": "a6beabd3-db22-4ace-9e47-f1206a1870fc", "value": "ea183a01d9380baeeb7ad8aba542b3d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d78285a-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686914188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914188, "uuid": "9f096bee-be1d-4424-b1c7-09612d4a6854", "comment": "Malware payload (RemcosRAT)", "value": "7af38624f20e3b203b724696a9672ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914188, "uuid": "97129d51-2c28-4f6d-9a72-6983fd70ced9", "comment": "Malware payload (RemcosRAT)", "value": "ea7e6b5688313cb532684ecc61a1438a40bbd32a0eb1ee7b1810086cb705aa09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914188, "uuid": "16c268c2-ef97-4e15-b785-bf95580f567e", "comment": "Malware payload (RemcosRAT)", "value": "d2fe24cb80e2c3ff877ed9ab60aab13fcef3c10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914188, "uuid": "d0141c85-7454-4808-9aef-b4e13bcc472d", "comment": "Malware payload (RemcosRAT)", "value": "a32ece79907732f746eeb2d79a8287e2fb1d04394e6b2700d0145c89e463e7bf20c04ccee45d337e7ac8c5f1d0b606e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914188, "uuid": "61ef83ce-289f-45d2-b8ab-8a9d8d7085d5", "value": "T1141523DD9B96C307E08B07FDC9283931977F46867262CB0B1D47B6E8A5A2F416510EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914188, "uuid": "802aec95-504c-4989-886b-2219e749bb03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914188, "uuid": "284af69c-3a54-4b0b-86f8-e95098000c07", "value": "24576:B5LA9RLSJQVyNDE/pbOUGgdciDBhE5BE2Up:B5LAvkS/pbOUGHeBUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914188, "uuid": "d27c0e48-7686-4f6b-b925-da74c05d4556", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914188, "uuid": "7770209e-101a-4f18-afa6-08d20541504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914188, "uuid": "bb303941-dbb0-4c29-91a3-7d44e10b5f00", "value": "7af38624f20e3b203b724696a9672ab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf289d51-0c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686892072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892072, "uuid": "5d71b05c-f781-4d48-9394-2ee5257ce175", "comment": "Malware payload (CoinMiner)", "value": "66651effcfaeeda4092379d1a64731c5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892072, "uuid": "b935ceee-7f60-4676-937c-c66faf9d6cea", "comment": "Malware payload (CoinMiner)", "value": "ead5ece96523e3ff2fef6e9c60f65ae6cdd160bef1c32ced53b4e4f3d43ddb58", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892072, "uuid": "8f27ac58-31a2-4a0a-a436-2f0e0a4609c2", "comment": "Malware payload (CoinMiner)", "value": "9e141a598d379081a42256b7e8964259d8163d74", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686892072, "uuid": "60805f24-e664-470e-bd86-e0f742c70975", "comment": "Malware payload (CoinMiner)", "value": "c81189d7948a90e82fcf00c84e46da883ca9ab8e7654c4b9c246fc0ec5d65e123112c6fb92fe5aafdd5741cb6ca7617f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892072, "uuid": "9a62f58a-548a-46b0-b458-6061e1445833", "value": "T1E806234627E22000C8718FB45678E1B072337E472925C71F56D6BE9FBF2364B7B626A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892072, "uuid": "265e6de7-3ce2-498d-a904-37723f3b7439", "value": "98304:XAD2yUozo9I2lYR0lcnYMMlX6gMEcGHVK:RB9feR0qpMV/MEcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686892072, "uuid": "c4a31e38-6c15-4b0d-8fe8-4583c23b275c", "value": 3707392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686892072, "uuid": "1321e23b-f596-4c75-883a-6ea024d7b9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686892072, "uuid": "18c50659-c270-4677-8891-002f7cc61456", "value": "66651effcfaeeda4092379d1a64731c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994a898f-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897592, "uuid": "89c585f2-62cf-4289-93ad-b28887e37115", "comment": "Malware payload (Mirai)", "value": "b9b5f3d27368d53b3530c6a2cb23b6ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897592, "uuid": "3aae8060-ec58-41a4-abac-1b43b819d794", "comment": "Malware payload (Mirai)", "value": "eb03da08cc232887fea0712c1dd601e22ffb610d52184466f1ce1ff5d7e69a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897592, "uuid": "d1c37e7b-e257-4903-a2fd-0583aec2d444", "comment": "Malware payload (Mirai)", "value": "1b6ad3f311d665dc4c15dfbf09bef64053d9fbf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897592, "uuid": "896f43e0-18fd-413f-aafb-3671c3c0a651", "comment": "Malware payload (Mirai)", "value": "f0b429dc987eed7db104d3284154e290a4a88d09a058860988a88f512e1c7953fdac56c267278e7a2a7277dc5b8c2449", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897592, "uuid": "178d8f3c-678d-4f04-99bf-143afec3596b", "value": "T13C83BFB6D20A5D31C189827060E48D793753AAC642AB6DB62AE7C57E8007EDDF408FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897592, "uuid": "9218cb8f-5dc7-4455-88cf-64f45c89e1a6", "value": "1536:XaH/2qYNkYZ2SzcCnLhdhMLaNVlJFySSkBw0BWPKvz3eH7OfCt44MCOFbwbZnN:XSe392SzcCLbeLITKSh5ASvU7OfkMRtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897592, "uuid": "05bea1e8-0bf1-4e41-86f8-64e90866fdba", "value": 84052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897592, "uuid": "0fda252c-2761-4ace-9e18-2aaf9d96ab1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897592, "uuid": "78ecc107-3578-417c-a608-78e09e839926", "value": "b9b5f3d27368d53b3530c6a2cb23b6ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10a5cdd-0c6b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686936689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936689, "uuid": "05454beb-041c-48a3-9e96-0d896a69f0ac", "comment": "Malware payload (GCleaner)", "value": "827fe076af5f7d59a1fb8f291da0c023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936689, "uuid": "9151a2a0-b639-4ce5-b627-0dcea3196135", "comment": "Malware payload (GCleaner)", "value": "ec17d3d911a38a5027956931d0761c64a8c771dfa124d49c9d59b787a5e9d641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936689, "uuid": "ce928266-ecc0-46a0-8ace-5c451e9cb7c0", "comment": "Malware payload (GCleaner)", "value": "8f60d19c4a109d968307022628f8e9ec18ba2886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686936689, "uuid": "863d1d3d-1e46-4a6d-bc61-dc4c3f57057d", "comment": "Malware payload (GCleaner)", "value": "467fc702ccec0916e1a5420186fc6d9645278a75dd4ef8865a4f820d380eebcc1e2d400839f96a06d466b83ff22299ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936689, "uuid": "0c90ad33-8a6a-48f1-b7b5-cfe0895dc3b7", "value": "T140C53353A75A2A78EC15DF743435AD22EB8B7F758079009C6DBE384D2EB72910C6224F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936689, "uuid": "58ee7d11-2a58-4161-b9e3-c52470489a2f", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936689, "uuid": "a438a38c-78ba-4f9d-9f0d-9abd71abac66", "value": "49152:U6dS3OKtEIqA1nsPPtcOFkyG2CsSAlZGtfriBw0Q6Qs+ILnwDOZ:jdwmfdcO+F2PSAlZQGBgs+VDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686936689, "uuid": "82b353d0-b8ac-4b90-9a7c-7328583c0a44", "value": 2600731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686936689, "uuid": "484c6de7-e95d-4ec0-ad93-507a51332111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686936689, "uuid": "038e7884-2667-429b-b8e8-1e2ece26b487", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528e75fa-0c12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686898332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898332, "uuid": "c08d4b8b-7c1d-4850-a8d8-cbf87e21194e", "comment": "Malware payload (Mirai)", "value": "3fe1a6120a41d7887a3a006eab9a1ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898332, "uuid": "43b039d8-9fa6-4871-8bf7-785dc8393854", "comment": "Malware payload (Mirai)", "value": "ed36163097df5d2c326850faa754707929143f9e59c987903aad1b7d9741ca7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898332, "uuid": "2f63919f-b7ed-4a0d-b15e-e9cd5ce3037e", "comment": "Malware payload (Mirai)", "value": "cc43e556f02d6db9d4cf4e72bb35cfd7eeea7b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686898332, "uuid": "66f3b1c2-50cf-457d-bfaa-1f5d9a2ff36f", "comment": "Malware payload (Mirai)", "value": "e851bc5cf7b9faa6945faadb2b2697bd6bcd5de4b286d2fcab9631fc669e28f18f4cf40ac0a7b369034b809a61b4d850", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898332, "uuid": "eda4c64d-eada-485b-8b64-5faad46cc534", "value": "T107E34C46EA818B07C0D6277AFAAF424933239764D3D773068D18AFB43F8679E0E63545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898332, "uuid": "a3f42143-711c-4964-b46b-b7c36dad52fe", "value": "3072:ES5T+cN5QKyKXvdM8giCKiE6/RaPNIMQwHKZB5XzGLYkm2LSM/9EYzd:ES9+cN5QKyKXvdM8gye/RaPNIMQwqZj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686898332, "uuid": "4f24fe08-7a9b-45bf-aa52-6f257e8098a9", "value": 155700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686898332, "uuid": "ef8c6d87-92e9-419a-98af-bbac4944a777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686898332, "uuid": "f2a111d8-df47-4be2-8bde-25efc83fedfa", "value": "meerkat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77048bf-0c65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686934257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934257, "uuid": "ef838ba3-0678-43ac-a453-3744d0afb86f", "comment": "Malware payload (GuLoader)", "value": "cfa47a96f7478f548648106b688c6944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934257, "uuid": "84c3639b-7a78-4926-a5c4-efca86830a6c", "comment": "Malware payload (GuLoader)", "value": "ee548086db277e0febd2797b582a734ac451a9cd050540d2a1fd08afa6232721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934257, "uuid": "56bc676e-4611-4c3d-ad10-699a19081f3a", "comment": "Malware payload (GuLoader)", "value": "e8a319a08641422e715666b62258d0e654820c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686934257, "uuid": "cb54268f-b1fb-4a46-80a6-811a3d087488", "comment": "Malware payload (GuLoader)", "value": "b246069c6a3d4d6a5a227a253d5e362a0cc9db20ed2e55b73fe1ac8b735dd504938ccf2d341550e9a7047f354213b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934257, "uuid": "ea31286f-24dd-49cc-8b22-aeea566c5a2d", "value": "T14AD401123A089DD7DE2E2BB14962C52E7BB334244A41EA077AE5BEDB7D523075C1F84C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934257, "uuid": "4258de27-32ff-4ad1-8ad1-de3ecbfbeda7", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934257, "uuid": "14511ccf-1850-47c4-a58e-6e279cf8df95", "value": "12288:R1mr+NBo/oJei4YB0nKuL0J1rboZHsbvegEsTK4Zc:R1TBowJT4+ENXH8WlSKcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686934257, "uuid": "3f157221-b51e-4961-a604-937836fff092", "value": 626989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686934257, "uuid": "8b08d058-05e3-4014-8144-d7a5b4fab4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686934257, "uuid": "734dae1f-cb47-4212-a39e-3e8637016634", "value": "factura Matelsa S.L _pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cffdce6-0c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686905115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905115, "uuid": "baaa16b5-be62-47ff-bcea-223dbf52796d", "comment": "Malware payload (RedLineStealer)", "value": "675a8bc6e65a9d04aa1e30fe80044e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905115, "uuid": "06733278-a67a-4d5a-9ebb-8e723d5cbd4d", "comment": "Malware payload (RedLineStealer)", "value": "ee940a7aa97eb3393467100d8e2a15887a794fb6f309b36486f8863d748ea22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905115, "uuid": "9538763e-2461-4104-b20b-c6ee3e65c86d", "comment": "Malware payload (RedLineStealer)", "value": "6cc8a3ce6a996588d29348f545e21ea227c79c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686905115, "uuid": "159372cf-4866-4178-8e81-134e40ae9a58", "comment": "Malware payload (RedLineStealer)", "value": "f6aa22a1f1a895f80b36a2b11738670048f3fcfcbf400240e30c15f9eccea0ed47cf90153e9416aa5059dce2da9f0ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905115, "uuid": "09622083-c046-4185-8404-9bdf7cb20ef9", "value": "T162A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905115, "uuid": "ee5a0016-8b43-4021-96a9-6021c0c01e49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905115, "uuid": "6ea3a4ad-8282-4de1-a5e7-53f5b0939ad7", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2T3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686905115, "uuid": "f34f2efe-0de7-47a1-ba97-4f88fa785e42", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686905115, "uuid": "da16620e-f5c7-43cf-9ce7-ae9481ad82ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686905115, "uuid": "e7f54e7a-3a4b-4090-9ead-185c68bc5c07", "value": "675a8bc6e65a9d04aa1e30fe80044e75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32432bb0-0c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686893983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893983, "uuid": "3f184665-b4c5-4fe0-a5c9-4cc66cca0169", "comment": "Malware payload (CoinMiner)", "value": "35c419cbf4e52d25e802918ab891f00c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893983, "uuid": "eb8328e2-86fe-4dc0-89ec-8565338dcf47", "comment": "Malware payload (CoinMiner)", "value": "f046e8b57cf80fd4ea776f361eb5065901ac6375cf3414d775fe1a5630cf4d0c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893983, "uuid": "7cf5db44-1975-4ab6-897f-b12723071cc9", "comment": "Malware payload (CoinMiner)", "value": "905cf4b7f42baa8a242fee61f7a2623ada988125", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686893983, "uuid": "1fc19340-ffcc-4370-a026-59a113b64a38", "comment": "Malware payload (CoinMiner)", "value": "b016f07229d037c41b51b57f448b816908bd4b323a8c813ddd7758ee6706623e38442181f90ce6f94f590262c95a6771", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893983, "uuid": "3fcaff4f-4164-46ed-b53e-abf61eb65247", "value": "T1A074088362F1BD41EA665B328F2FD6FC761EF251CE497769221A9B1F05B02B2C163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893983, "uuid": "9af4980b-1860-46d1-a835-65c5dfe9ee9b", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893983, "uuid": "cf9a8713-a130-45af-9fde-88e35792157d", "value": "3072:ASM0Cgq9V46vYJn0Yn5o7P4FUDqGN9L+eW8KgFcEKU5VXj20/T:Q0Cp9aNB3neb2OoetcEKMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686893983, "uuid": "d606de76-1b66-48df-991e-aac56b6539f5", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686893983, "uuid": "11138e10-4b35-4b0c-bfaf-4fb59d24e2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686893983, "uuid": "551f6586-5d79-4256-81a1-d2cbddd38dea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89faf488-0c51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686925484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925484, "uuid": "d52a3c16-77ec-40b5-acb5-f68406cc16b7", "comment": "Malware payload (RedLineStealer)", "value": "63acc580937a0e5774ebaa062bb2a77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925484, "uuid": "ce103d1b-2577-47ac-9090-95fc9bdd7b16", "comment": "Malware payload (RedLineStealer)", "value": "f107eeb431a43d7f1f26e3729a58420d2556ec9745e48da5840e3c1218b7aadb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925484, "uuid": "8327376c-d93b-493e-a464-6442df182067", "comment": "Malware payload (RedLineStealer)", "value": "b0333a3b7b35679e962c690256b64ad6b9fbd803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686925484, "uuid": "c1e9dd92-8e75-4fc8-bb85-62d3e3c5450b", "comment": "Malware payload (RedLineStealer)", "value": "ebef67055c58bfb720dac28384b986d804e413bb0fdf07ac62fcd2e096088c62ab7cd7fc2932eb1b8b1ea2172ce8fb28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925484, "uuid": "3ccc6eb6-acce-4681-b8e5-0b99823caabd", "value": "T1A5A43A13A2E27C55E5758F72CE2EC6E8371FF5504F697BAE62049B2B04B11B2C263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925484, "uuid": "f4cf77b9-9a93-4743-a7ae-6b000a4d3f35", "value": "e712b9ea811eddc692156be9406ceff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925484, "uuid": "352a869d-03a3-4515-82d3-d8e28f8ab466", "value": "6144:k6Pp1qS1mSMNNJNQm0+pMa7/ul7Lzi79KmrecCwZuB:p1qumSMPQ+q8YvigMerws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686925484, "uuid": "399282d8-818e-43ee-a1aa-933996626efc", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686925484, "uuid": "2ad45ede-3a9c-4b1b-8aea-153fd158569c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686925484, "uuid": "8a096a4f-1e08-436e-8585-5c5af300f9e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b701452a-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900648, "uuid": "07219f61-a898-4047-884d-85984fdac52a", "comment": "Malware payload (Mirai)", "value": "6361feba879fb577cb16341792035195", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900648, "uuid": "eed0f347-3882-4d60-8ef7-bd87d91108b4", "comment": "Malware payload (Mirai)", "value": "f11857281640c38abe525cc14dfa75ad06fd61037d2d294bf3501b88aaae23b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900648, "uuid": "8733a44f-14cc-4a92-9c5b-0b5c05a64458", "comment": "Malware payload (Mirai)", "value": "465267689f3a3e4795c66998849eda07b307b48b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900648, "uuid": "0c7fa66b-e629-49b4-943e-94a3dd9a7154", "comment": "Malware payload (Mirai)", "value": "326d2cea2322dcab3aad0ef2d2f943384f04189c11a53cab2a2f7369f61b1487a9750dc4a4fef8bef86d4a17140db79a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900648, "uuid": "33c18d7e-3023-4ca7-aad9-fb09e5cf1b76", "value": "T16B03E1F4F1915FC0F5E88BB92660DFD46BD1ABD43612CDB1A3087A16A516E2E831A0C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900648, "uuid": "37418b80-7bde-456c-a352-2bb0792dea22", "value": "768:c3h5sEd4txjnVCCG1vVvEYfvrP0q34LlccwZ/ht3iX4uVcqgw0RNWXt:c3h5sEd4t1VqvV1vr34JPOoX4u+qgw06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900648, "uuid": "a4334dd9-d4e1-48f6-be34-8e96be9c3596", "value": 39304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900648, "uuid": "06fd7bee-88f7-49b8-b7cf-2015ef3c1c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900648, "uuid": "246173f6-b271-4e36-a9da-979820a163f2", "value": "6361feba879fb577cb16341792035195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699588b2-0c81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686946045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946045, "uuid": "f4a4d207-06ca-4d65-82a0-c0b059211261", "comment": "Malware payload (DCRat)", "value": "a3db72d8b9ba7916dcba688ad1d64061", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946045, "uuid": "e1499f03-8c27-454a-bef9-6282e3679841", "comment": "Malware payload (DCRat)", "value": "f1e5829e0f9473127d72559e3f811dcb5158d22e09eb4925ef27c7ada864fe6f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946045, "uuid": "75aab9af-bd9f-41c5-98a5-596f9579e7fb", "comment": "Malware payload (DCRat)", "value": "aaa5ae0c8caf293960c4fd6b443f62422d1bb45a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686946045, "uuid": "5d67bf7b-c3fa-4087-a9a6-ba2913003e0b", "comment": "Malware payload (DCRat)", "value": "56ba13b804cd5a46d9e23a5e5ab692e96f0936f38e8f5fc22015c52e840ece1a6438599b222f53970228d3b771320d79", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946045, "uuid": "8bc2a177-1975-4354-ab6c-ea248922472f", "value": "T1A6235D0037988136F6FD8BB5ADF391458679D66B5903CB496CC810EA2B13BC697036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946045, "uuid": "9dc6344e-9922-4204-996d-3ad8083129a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946045, "uuid": "b47de84d-b247-45f0-8c97-d5b451586fb8", "value": "768:Eq+s3pUtDILNCCa+DiPC/6oDXsijHR8YbOgv95ttZXp2vEgK/JDZVc6KN:Eq+AGtQOfoDXrxzbxzZInkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686946045, "uuid": "0089ee99-7b7c-431a-823a-428b72815eb6", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686946045, "uuid": "ba67c70c-7af2-4c03-a673-03100764d6a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686946045, "uuid": "711a21a4-ae70-4223-bc50-3e1409e0acd4", "value": "bN8l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0175d48-0c57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686928205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928205, "uuid": "3496b29c-cc21-4186-9ce8-9a657a3d66dc", "comment": "Malware payload (GCleaner)", "value": "1ce9ed69d8f6258b87fda54ec1c7c1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928205, "uuid": "2bce96f6-502c-49be-899b-a10307098c5d", "comment": "Malware payload (GCleaner)", "value": "f2aae6930d05ae9f9df00e612c0c76a7d206194c06ceb9d3f7822bb179fae74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928205, "uuid": "4efdcd9f-d052-4f8c-b96f-e65c2f67d14b", "comment": "Malware payload (GCleaner)", "value": "ae21f8a7a29aa5f185736be1bb9e6aef60a55cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686928205, "uuid": "b3e80f22-7e21-4e43-98e4-9168f0eaa2fb", "comment": "Malware payload (GCleaner)", "value": "6f957c66588aad22ca3e5874cb4c95d3df7e1c4635d4d6e330420a26bb1593da4f536ca8c6465c4cf04aca30cccf4865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928205, "uuid": "45b1e448-53cb-4051-aa8b-b4bfc35ef92b", "value": "T1C4C533D3C3D59DF4EC7B92B038268E255F2B2DB78C7A0094568E792C1BB31C21D79296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928205, "uuid": "231b4a25-5994-4f1e-905f-f8ff7ba8af50", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928205, "uuid": "afe3b180-83c2-488c-894f-4f70b95bf255", "value": "49152:U6dlTQBdYsKyP+bOap6C+lZSXh3o2EinHZkzN50X9rbYHzuViwx4znwDOZ:jdFQBdYvdQCtXh3hEiHZkZWNrbTVrDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686928205, "uuid": "14e7f949-86e3-4fb4-bb05-2e60b9e131e6", "value": 2587108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686928205, "uuid": "92a529fe-bb37-4cdf-bc41-b2211feafcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686928205, "uuid": "d8e86d09-5553-44b3-b79d-f3c3e780c629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff39a9e9-0c34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686913225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913225, "uuid": "ebab3da3-aa94-4609-82d8-6fb07247019c", "comment": "Malware payload (Formbook)", "value": "571a7a86aa6bdda404b67c04f13fac00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913225, "uuid": "267005de-52f6-415c-8742-89a98184ef20", "comment": "Malware payload (Formbook)", "value": "f3053c7e048f3a0446a3a5b005a73173720e037f7372c4dad57955b23c42d3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913225, "uuid": "d1d26cc9-d6ca-4d4b-90e9-989d848f61dd", "comment": "Malware payload (Formbook)", "value": "22d29ce0faee8fce493041066f960a298f50fdeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686913225, "uuid": "8b074d56-6ba9-4c4b-8584-1d80b016a76d", "comment": "Malware payload (Formbook)", "value": "5069ef503975be26b3522ff145159dc4d86d32a14cae0f683099c009deb0620b57d6c423a27a40b5298ffc5fb7f16f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913225, "uuid": "6ebc64a0-8934-4484-a177-dd7cfca01ca0", "value": "T17AE422A86A2E8717D06743BC4E207F74436A87B6353AE7470D97B7EEA6A0F500440DB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913225, "uuid": "2c80d22f-3f3b-4092-8215-8f6d7f876632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913225, "uuid": "7aab722d-3161-4c47-9ad0-20744b2847c6", "value": "12288:n5LbzIu9+r9ZRCy1ptBImheEdG1cfwuojg8DWWYp9:n5LA9ZRPP3IK2qyg8a39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686913225, "uuid": "cd603cc5-a8a7-40ee-b60e-f7ed5ed2e0d4", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686913225, "uuid": "ad48bc48-0a41-42d6-b366-e34a0176f383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686913225, "uuid": "ae8775cd-8ee1-40ff-8bfe-43e93ac4073a", "value": "Mirus Packaging GmbH Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282dd811-0c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1686894396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894396, "uuid": "f2d4ce3d-276c-4f57-b2ff-af0412f50e1c", "comment": "Malware payload (RaccoonStealer)", "value": "af6e384dfabdad52d43cf8429ad8779c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894396, "uuid": "6bb83f91-bdee-4110-a0c1-995d07e15614", "comment": "Malware payload (RaccoonStealer)", "value": "f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894396, "uuid": "4cd3924b-baf3-404f-a092-2bb1a61ef2e7", "comment": "Malware payload (RaccoonStealer)", "value": "c78e8cd8c74ad9d598f591de5e49f73ce3373791", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894396, "uuid": "b4d7146b-cd64-4524-8160-70d0b36db3e3", "comment": "Malware payload (RaccoonStealer)", "value": "3fa2d5b8ace1dc8b7bf6172524f5a1b9b7846ea6ccb83c055b41235bb01585b8ec97f40642bb31ca0115ebf7db17dfa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894396, "uuid": "7923f79b-a6c1-4206-bfa6-edb4107d54a5", "value": "T10F262351B6DABD58F839E2B55BD7C275061AFCFDC15A0B3B11893219CFB22413E1382A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894396, "uuid": "b9d2d674-3dbd-4c87-827a-f69096c0211a", "value": "28410aacd961a705a3e199dc5b1733bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894396, "uuid": "ac0803c8-9de5-4b74-aeb1-1c26868e78b9", "value": "98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894396, "uuid": "ca3fd1aa-0b47-42db-8020-9ef76eba4c20", "value": 4563640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894396, "uuid": "cd4a17c9-4539-4eb3-aad9-a0ed42957938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894396, "uuid": "81239168-8103-47fc-a744-2e7895d955d8", "value": "af6e384dfabdad52d43cf8429ad8779c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05e8c32-0c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686896396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896396, "uuid": "3b7d38b7-8e2a-4e62-b500-80b5b1f070a6", "comment": "Malware payload (AgentTesla)", "value": "7e1c03bada58a8b918b675894c5b0492", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896396, "uuid": "05e6b00d-ec6d-44d2-8921-105636d419f1", "comment": "Malware payload (AgentTesla)", "value": "f4992ccd1efb1526569676630c916c68f1bc0ea3ca0061286d22950244666f64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896396, "uuid": "23c0c966-c33d-4fbc-b0c2-2e167fccd00f", "comment": "Malware payload (AgentTesla)", "value": "b23efed3e7ab540379fb9863e6d7bf445c456199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896396, "uuid": "a12345cc-6078-4b76-aeab-188b0a17b1bf", "comment": "Malware payload (AgentTesla)", "value": "f0b8b56ec9833aca27d9ce39fd23ddc936207056b5af58c2a4764d3888cf8681b2165b0c26356a80437becaac33f58b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896396, "uuid": "8bdd6f31-930e-48cb-8e55-1f85538e94ea", "value": "T1DBF4E098325075DFC817CC7B8A986C64BA2070BB930BD24791531AE9DA4DADBCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896396, "uuid": "271b55ff-c8d6-40d3-8bd1-9d6508af71ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896396, "uuid": "d5ababdb-7045-4dc6-9bc5-60a7efb7a0fd", "value": "12288:beAlrBf7dil/ws3LRP9jhzA6wnsfB3QPy6EJ2SAsAr3AGBIxcsuNsJjoRh1UF:qAPEIkR9N1BQy6EJ2KArwGC6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896396, "uuid": "befd488b-8b20-49ee-995c-65a3ef501ea5", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896396, "uuid": "723d1d91-da86-4565-911c-f2d580d06d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896396, "uuid": "d071d0b5-fd73-44e4-884b-555aa0f5d72e", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cad1f69-0c94-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686954291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954291, "uuid": "de33940b-f385-460d-8ad9-da9b4249557d", "comment": "Malware payload", "value": "767852cce4cb83c2457bbba4af6c3715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954291, "uuid": "0b819a99-2194-46d5-ae68-740232cc1be1", "comment": "Malware payload", "value": "f49a983be1ea7a8c848a60a8ba0d4ff5022d3bc89b9e10cd490e36efdf81a46c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954291, "uuid": "79dda8de-7fd8-4d60-b6d9-a9a10dd72309", "comment": "Malware payload", "value": "9f4522405fb935ff5d926063dc1f9297bd344363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686954291, "uuid": "8582ec6f-12b0-4993-a0fd-05e173072a36", "comment": "Malware payload", "value": "81266a5cb1516d16bdce15ed63bbcf407f1553bc362e5aa2b5fb2bd225ecda2ca8f7afde2ae3fcae88d9566765235cff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954291, "uuid": "4c48a212-b5ad-467c-87b9-a9e5f5c86b1c", "value": "T132C523199DC2219DE84E91781AD3FE3D71F80B3622538D5B6D7897E7A9B3024B0BB413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954291, "uuid": "cc7b9ddf-1707-425c-8a88-154951260ff7", "value": "489c2d7f1810a16e0e3d8a08d94a3210", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954291, "uuid": "8e838e1c-83f5-4d8e-970f-464e7be2b301", "value": "49152:ljgj62mKY1c2Quq9M3OKTStTUfwvdrU3upMhZqe+YR67T8rwWbqgN:lcOKYO2XqK3OKTUUIvV+g+Een8CPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686954291, "uuid": "dd9b20f4-d812-4f28-8118-36691f3460a4", "value": 2732448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686954291, "uuid": "fdc39511-b1f8-4394-8224-d1828611ce0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686954291, "uuid": "6b207c42-bb7d-4e21-84e6-d3e0066f5505", "value": "767852cce4cb83c2457bbba4af6c3715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7482d2f7-0c3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686915569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915569, "uuid": "8122d7cf-f33f-49b5-8a59-8a7282e377e4", "comment": "Malware payload (Quakbot)", "value": "2882b8bed977fdbad332fd61c4f85526", "object_relation": "md5", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915569, "uuid": "6681bfa2-9a38-4232-ae81-af67c5fefe39", "comment": "Malware payload (Quakbot)", "value": "f71ad258d7f25ff95300b4e416341a6a17f39cb85fde2826820a0e12c042f10d", "object_relation": "sha256", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915569, "uuid": "60cbc123-38e6-432e-a84a-0510cf6b420c", "comment": "Malware payload (Quakbot)", "value": "2399976dbf0bf86ff6c951ae4061195401cd3e2f", "object_relation": "sha1", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686915569, "uuid": "10627973-c7dc-49ab-a7c9-cbf3af91d210", "comment": "Malware payload (Quakbot)", "value": "4860f9b7faafe3e4375005c31168ba4850796fd32d6eea0ddb858bd8e5415c9c4bb5b7b65072aec38be2a90a3854e050", "object_relation": "sha3-384", "Tag": [ { "name": "1686908761", "colour": "#E77998", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915569, "uuid": "628b8414-a46c-4d39-83a9-be1410e9a53c", "value": "T1BAD38E9CE95DDCCCEAF1A7F2A3B1F0E8C24D73638EC518B2295A0F975103C69D956482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915569, "uuid": "cd98ad18-07c9-48fe-9578-eff529a5e2fe", "value": "3072:iU8F1uobfaY8P3QYYYYYYYYYYYYYYYYYYYYYYYYYYYYYPqPcOug72yhbfhP:i1uobfaYs3QYYYYYYYYYYYYYYYYYYYYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686915569, "uuid": "6cfd7f15-ad8d-423c-bf57-1c3d43a1dce9", "value": 141227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686915569, "uuid": "45c8801d-f87c-42b7-a6d2-8d8db5ec8a51", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686915569, "uuid": "c5caf217-cb17-4873-8667-64329394a9ce", "value": "rt.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca41c24-0c5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686930401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930401, "uuid": "60cf6fc7-d400-44d1-b81a-3720f1801297", "comment": "Malware payload (Rhadamanthys)", "value": "5f86597ed65028f455590bbfa9a183bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930401, "uuid": "dbcb5209-aad5-4b4c-82be-0959033aa18e", "comment": "Malware payload (Rhadamanthys)", "value": "f72db6936eef06dee9230bb27bfcea84a66773e419807f355bf37fb3f5457947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930401, "uuid": "3ffb4116-64fa-4ca4-824c-6a4a7b8f194c", "comment": "Malware payload (Rhadamanthys)", "value": "49ea64be7dd9a244554bbe5c7d9b6b228f01dfe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686930401, "uuid": "cf738509-7d08-4780-9513-5741098c2604", "comment": "Malware payload (Rhadamanthys)", "value": "d84dee35712d0ae6be7ba9d9f7022c639b8452c577abf353a12d17d90b5dc252e21388d36901f32ad6cc800d5e5def09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930401, "uuid": "c70307b5-1415-426b-84e5-9ddb678bd828", "value": "T1BEC48C03E2F27C51E6678F728E2EC6E8361FF5608F5977AE52149B2F05701B2C262725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930401, "uuid": "7bda6b70-51b7-4bf6-8213-734a8d091d78", "value": "3a5f6a5d41ba9c7842f3de1ad1b4f692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930401, "uuid": "a4fb3c54-d982-46b0-b5ed-3e63c3a02195", "value": "6144:qpYjSC3awRUpX2bXg84/pfnSkF33ncHHNSpcDTJPC/W8WVW1c0jFQs+raIpB:rGC3aPpXeM3nqApQT3XHAQZraw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686930401, "uuid": "b68f2929-3dcc-4a7f-9fca-3053072ce25c", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686930401, "uuid": "d1c775f9-d5c3-4d4f-a35b-44e8fcd50b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686930401, "uuid": "cdb78e80-7b32-451e-b4eb-791576ee1ec3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eabe05-0c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1686894317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894317, "uuid": "9250087e-470d-4505-b1db-de2b134ec3a0", "comment": "Malware payload (Vjw0rm)", "value": "0a408696cd3ce383aca0ebd3f71ded39", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894317, "uuid": "1d8ef796-d139-4474-a5e6-b856ddbb74ed", "comment": "Malware payload (Vjw0rm)", "value": "fa304b07a41067eb15b646db4dd96d9be35e14684d20d7c74cc231b628212b53", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894317, "uuid": "37f46e09-081b-474c-9b74-6258dfc585dc", "comment": "Malware payload (Vjw0rm)", "value": "d9055c216f4d5324422d2aceb5b5f8e8940cd508", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686894317, "uuid": "c90f0a10-c59b-4953-8ab5-2e65e7dfd2b9", "comment": "Malware payload (Vjw0rm)", "value": "fff35d63c0599289262e3a1a1bc3ec3b7bb5e86c24e507d31b9935ea4e91436f1d2c9ec4f42f01dc4da56cee8a279722", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894317, "uuid": "981cf87b-8c9d-49c1-9056-5275f3c3189d", "value": "T14B34435F331C57F4A9E71C89C3DE95BBD7C8CE15F01164A2FC74A00229192B1E9EDAA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894317, "uuid": "c85a5a56-2810-46cd-ab41-0ac5bfd59e83", "value": "6144:voKqxDyKEDy41DShrQJYbMhERCGeGK3AklgF2GuuZde:Qo1DSqYyE8GKPl029se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686894317, "uuid": "1f8802c9-1829-40ad-9b6e-6de2d15c8dab", "value": 241657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686894317, "uuid": "a437b0f6-cee9-4c7a-885a-a58b43cb7745", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686894317, "uuid": "39634cd8-4141-46ae-b374-df73e07dfdf7", "value": "Order-POOPXDI23240044.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e05da1-0c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686895030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895030, "uuid": "3b3ca4ea-590e-4650-8f25-e2985f1c8cbb", "comment": "Malware payload (Mirai)", "value": "63a9b45a69bfa8e42df3d82c447cf55e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895030, "uuid": "f2c380f2-aa05-4575-ae33-3e4c39e9b19a", "comment": "Malware payload (Mirai)", "value": "fb827101fa742773df704a152994d338be2fc81c5a0e9436ef02f52ac2ec9929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895030, "uuid": "f9d8fead-8aeb-4d1d-ab5a-1674e7e65b2a", "comment": "Malware payload (Mirai)", "value": "d9722ba9b1b7f701a574267c098aac979582ac55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686895030, "uuid": "11205679-53f7-4354-99fe-5a5b3f88ae5d", "comment": "Malware payload (Mirai)", "value": "855eaa9b61439e072451300a3fc4bcb8a63a8a7163ffcc9764e565c466178c84c64a817bc588a4a677bb3dcbfd2ab450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895030, "uuid": "6a76293a-6a8d-4377-b5e5-d3103671b543", "value": "T184C2E1F97F1E6627F54C5238E639012303DEF115C36AABA267C9A07254E7154B234CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895030, "uuid": "9a878f82-47db-492a-b5f8-c15a8dc1b003", "value": "384:MX1DMwk8JPyGnT8WyopNfOFDp+dK6YOpszGVu5+9XmpcUKJinhPYGKOGMrmNy0N7:qMwxdyojdVFpszGVtycjcnpai70N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686895030, "uuid": "49c17e9f-bf18-4b32-9834-592a6a243831", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686895030, "uuid": "083a5d35-8137-4acb-8342-2586b955e8ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686895030, "uuid": "05f8335b-1dbc-4d2f-b0b0-c49c19f754a6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce690bb-0c6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686937380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937380, "uuid": "7a48b93e-4fa1-49a0-86ff-249550e0b7bf", "comment": "Malware payload (Mirai)", "value": "ca2fb4430f695690e9e0ab5dd2cb1545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937380, "uuid": "5a329b44-c2be-4568-bc66-73227d42bf09", "comment": "Malware payload (Mirai)", "value": "fc04c099626b60a2669a1b2901f7dd8f38f51af10890eda0b1b3e2d178e22b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937380, "uuid": "ceeb5405-5860-4935-a581-1556c63ca54d", "comment": "Malware payload (Mirai)", "value": "d80ec346b6eb989dc94430276143a543c5354b78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686937380, "uuid": "a6ed8655-78ef-4d6f-bde9-5562290cc75d", "comment": "Malware payload (Mirai)", "value": "c1f5431f5038fb99949d65933936b2a95bcb87e7a6c5ecc17afc686da6f14270a138212662da3bb7dd2d898c1da1430b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937380, "uuid": "03340174-1716-48b1-98b2-3216fedad777", "value": "T1C9735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937380, "uuid": "f29ec221-f386-41af-8dc7-de07ec53cf37", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8S:YwfdNu4cmZvFqI3w7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686937380, "uuid": "eef340f1-f816-4009-997a-f77a58235609", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686937380, "uuid": "b81eea3c-3648-42b2-a7df-0af0dd0299bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686937380, "uuid": "4e5b75d1-8c3c-451a-8579-8b5f4e03d82f", "value": "ca2fb4430f695690e9e0ab5dd2cb1545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a95b0b-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897604, "uuid": "16b21e6f-c78d-4548-9a99-7b72b52c3026", "comment": "Malware payload (Mirai)", "value": "bde2265a3f925055eaffd990921d7735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897604, "uuid": "783cb167-82ac-4f0f-881a-73e7e6cfb947", "comment": "Malware payload (Mirai)", "value": "fcd141a30d760b9c8f52c7784ff7addaa91c5ab31012c493bbacaeda7464d084", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897604, "uuid": "4bce6f43-2c44-4e4f-93c9-6a545e3cab77", "comment": "Malware payload (Mirai)", "value": "1ba1b77bce3244a9d91f8d23bb7d46ba2fd7b01c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897604, "uuid": "8e828202-7de4-4007-bc04-b3e29315a7b6", "comment": "Malware payload (Mirai)", "value": "2ff6fe144961a4b237c21cd2d84c3a77e63b5bda8491307812ab205d7dce4de3ab794775f844c8f3ef7381c98dbf20c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897604, "uuid": "cf5b147e-55b5-4ea1-97d0-0636d7a5d9b8", "value": "T11313E140E46C9BB1E27FBEF57C156262FA370EEB25349DE11141DBA2460B1012A77FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897604, "uuid": "fce2933f-1a5c-4bd4-af8f-14ea68ee9180", "value": "768:EIMrc54umKyQrjpcicTf1L3wVChxjOmd6pfTg4L//6q4uVcqgw094:EIMrc54uhZp5c71L3wUfjT4O47/6q4uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897604, "uuid": "9f7ddb4e-71e2-44f3-bdae-bbe801063163", "value": 41440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897604, "uuid": "512e3c9c-6648-4f7f-b331-fadf4c38a0e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897604, "uuid": "3289b004-abba-441f-aa76-f39ad9b45525", "value": "bde2265a3f925055eaffd990921d7735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba48d20-0c3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686916225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916225, "uuid": "6f6f892d-664c-4200-acd2-5f31176ecc04", "comment": "Malware payload (AgentTesla)", "value": "925b613512fdd232b2be0f681543ab11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916225, "uuid": "6a2089bf-310d-4192-82e4-769c0a67757d", "comment": "Malware payload (AgentTesla)", "value": "fcd6b40df9fe59d0322697bb4c2dc465f64e664e58846227e32ea7c6f11252e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916225, "uuid": "98faeef6-ea88-4599-a3d2-bcc9daec95fd", "comment": "Malware payload (AgentTesla)", "value": "af902d9b24ce7fce3589f0e60c0682b66835b950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686916225, "uuid": "b8a50265-def4-4bfe-ae5a-63e9d4c92e60", "comment": "Malware payload (AgentTesla)", "value": "6cb50f16dff1c1e3020c11be7dae73001babe0a743fde10428e11684d7df6ce11e1b18ec2926e369864994f3dd5a5ed2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916225, "uuid": "389033fc-e81c-4a2b-8f0f-f011ad75dc90", "value": "T1F1752212FBC28472D1221D329AB5AB209E7DBD601F718BCFA7C01A1DED719C0DA357A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916225, "uuid": "50a2b363-c717-4242-8401-fd9ee396084f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916225, "uuid": "a38834a3-7de5-497e-a1e2-4383553b7133", "value": "24576:tTbBv5rU3HeTrdn/cIj37B2uC/EZQ/J+4k+lCj4bDtlKmoGusfdpizjnu8Z:nBUeTB/cQ37snh+KlDtlKCu1u8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686916225, "uuid": "b502c695-4f2a-44cd-8893-3004beb4cbe8", "value": 1640254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686916225, "uuid": "0a725c87-ef52-4648-85ff-ea9456263eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686916225, "uuid": "e3277d19-26fd-4bde-879a-84008a66168a", "value": "z32NewOrderPrintList_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5851ff-0c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686897575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897575, "uuid": "40eda3d7-1265-4309-a18c-52b6685cdd06", "comment": "Malware payload (Mirai)", "value": "8634b3907c3d1bb9658a714a876d0001", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897575, "uuid": "4d9ec098-53c2-49fa-8306-0640fe423309", "comment": "Malware payload (Mirai)", "value": "fd3522d2d98b79636e1e0e3b5d23f49da28aa99f75051a49d78d38c551a5fa0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897575, "uuid": "5c73738c-101e-47a8-816a-2df6bb68bfee", "comment": "Malware payload (Mirai)", "value": "938b3074dbe5c40abe9dfe7dc894a31be6bf0022", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686897575, "uuid": "cda4cd05-feaf-444d-813b-c441182c33a3", "comment": "Malware payload (Mirai)", "value": "0fc769326ca88fcef64f629aad73fc66d6c3f4197ac5329288946e04a694bf36f2919514ed2c74c3e73836ac56c74f16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897575, "uuid": "202b9aaf-b20a-4a3b-b7b7-47eaa3f23dea", "value": "T10713F1110096C8F49661083DEE3AEF62718A61EDF4B5F7B20AB44D7CB3C238D91F6855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897575, "uuid": "67c4ca52-68b3-4e76-ba34-8bb03cecbe57", "value": "768:C4f7TNX3popENBYP8VpR4ZGwovkgKKBSw/02VBBut19LAr/x+BCdts3Uoz7:CETNXZouBYP8V1ZvzBoc9ButfLI+BCdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686897575, "uuid": "6b55a429-db90-4377-879a-b2362afb9338", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686897575, "uuid": "a92a4c45-19e9-4405-b019-08f4dfd247b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686897575, "uuid": "c9dd1dea-ae9a-4312-8e40-fff8c9dcca28", "value": "8634b3907c3d1bb9658a714a876d0001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac6d49-0c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686896524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896524, "uuid": "26224da0-dcbf-4721-a0ea-1556fa67f992", "comment": "Malware payload (AgentTesla)", "value": "5119c03df1becd83ce7de22565c5fc4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896524, "uuid": "70a9cf6e-e1c3-4a9e-9bb7-bb048b894f7e", "comment": "Malware payload (AgentTesla)", "value": "fd4226a0d754290aa133ea1a8606846290cac4ec317a8622072d38fca80e8bbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896524, "uuid": "5d410672-0fa4-4cf0-b4dd-d63fe75e0894", "comment": "Malware payload (AgentTesla)", "value": "66bbd656f3476d4fee3c430724b1392a1bca92ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686896524, "uuid": "d540afa0-9754-46a7-9d2a-9157ff635841", "comment": "Malware payload (AgentTesla)", "value": "ac1376784eeb7d64cf2fc404d7c818b91d3a627361c424b4927c80acb7e23d5582fbd43ce0b8f1619464166332c12578", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896524, "uuid": "63d2507e-6c03-4f0f-b398-cb8a38a79134", "value": "T132F4DFA9762035DFC45BCD779A981C64BA21747B530BC653A02306EC9A0DADBCF285F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896524, "uuid": "8ce675d1-406a-4690-80b7-59aa7ffa6c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896524, "uuid": "807cecc3-97c3-4e2a-81c9-4b97850b027b", "value": "12288:sVRQIcb2Cx71529M9tKZ424z8Q/meusGyi2QNixRFMESrROrQza5KtbGIQrOMRCV:ORtcb2Cxp52GtW4hYQ/PpGN2TXO88z30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686896524, "uuid": "2516665f-0c4a-43e9-aa64-44ccf062a373", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686896524, "uuid": "7d5f19de-ed3c-4842-927e-31de44db5933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686896524, "uuid": "4bd929a7-951b-4d9a-8c2f-a8cf83a4258d", "value": "Modis list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be63b700-0c17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686900661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900661, "uuid": "8e928a4d-f28a-4e56-860e-1f1c265832c2", "comment": "Malware payload (Mirai)", "value": "06b2093dce31b05e86e0bb6b76ce96d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900661, "uuid": "1d96be71-cf9b-4110-8d08-1000ccb4aa0b", "comment": "Malware payload (Mirai)", "value": "fd89d8a5bec9ef81fc44b10eddcb4919fd10ba3ed177cb61da061318ca33be1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900661, "uuid": "a3cc990c-e0a1-4859-b86d-ba7d082e8f34", "comment": "Malware payload (Mirai)", "value": "5801f732abf7b5914f212bcc9b8be83294912dfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686900661, "uuid": "378afba2-8908-47f3-a80a-8872475fd270", "comment": "Malware payload (Mirai)", "value": "d0b81ad865da988799a5eead3064bfd9a96497c9ad5461bc24b45aa0f6b6ff92a50acc8322356c1c48e0f19495dcc59c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900661, "uuid": "70d06c6a-14ae-4b50-919e-e4bf0280e3b2", "value": "T1D693B419BFA50FFBEC9FCC3749A91B0224CD651621A93B75B934D818F25B24B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900661, "uuid": "9138d16a-6f30-4cfe-95a8-22ea4cae3c76", "value": "768:BnJDTFOU1Q05gol6SR9KhE3jU1tnzDh5YUeYOezgeR9GAlNYwN36gT3OXilYra7/:lPOU1Q0Ga3EDhV1OygS9hNVhrka7ggX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686900661, "uuid": "638cab73-abc2-4ca7-a3cb-a43748c5e1fd", "value": 96656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686900661, "uuid": "f1ef23f3-a70c-4b80-b223-4b219c5fd3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686900661, "uuid": "4b44c2e2-8d66-4fad-a1ec-5f0d99dd3475", "value": "06b2093dce31b05e86e0bb6b76ce96d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ad547c-0be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686877031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877031, "uuid": "8ca13d9c-fc20-4aa7-936d-b1553ae1b961", "comment": "Malware payload (NanoCore)", "value": "361a307aa011a08ffdc64ae2999c7349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877031, "uuid": "fb6b9fbd-5174-4cc5-ad5e-2f7c6090806d", "comment": "Malware payload (NanoCore)", "value": "fd9245bf4c0432d082100f0c612d4f686ad3f7005f5d666fab2eed414ffa1093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877031, "uuid": "ef9a7621-0d32-4022-a111-e2677b614c7a", "comment": "Malware payload (NanoCore)", "value": "4895d3383401bb34705f406af3ac96e4b606f7f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686877031, "uuid": "5bf1d1bd-486f-4c94-9a5b-32f1985fd0e9", "comment": "Malware payload (NanoCore)", "value": "de60128319030f38c0e50c159ac9d92de26ff0df77687aa424c808f0a1ac9879ad327586eadd6d168e47bf65ec9dd946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877031, "uuid": "5ea0169d-71d5-4c18-92f8-8774e3daeb95", "value": "T16E14CF1677E84A2FE2DE86BD60225252837DC2E7A8D3F3CE18D465B64F263E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877031, "uuid": "276b08a0-2879-43aa-aeac-f66d87ef53cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877031, "uuid": "03089e3c-fb6a-4646-950c-4fc9b210dc55", "value": "3072:CzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIKnF+BX+4D9kNh5y/NMCGEWz:CLV6Bta6dtJmakIM5HMJSftpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686877031, "uuid": "43171914-a993-4d9e-927f-558ab154a141", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686877031, "uuid": "fa02b125-719b-40e7-aa9e-536b93c635b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686877031, "uuid": "979fe044-cbbe-4e32-a6db-d71fac23ea92", "value": "System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ad1b47-0c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686903037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903037, "uuid": "175e3697-4513-49a5-a7e8-d9d097dd9f44", "comment": "Malware payload (Mirai)", "value": "1b88f4b5098444a1fddadc33ddb55316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903037, "uuid": "0d43ff63-f346-4aea-a394-e64e69aa14b4", "comment": "Malware payload (Mirai)", "value": "fe69d903aea9dc34f99619739c47f32d7f7293191e520ab4e4ed8ea32c7bcd56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903037, "uuid": "bcf19999-ab4d-44df-a8a0-8fd806787549", "comment": "Malware payload (Mirai)", "value": "18581f1446e6d2dce2d18fb53e6a73d0bea23d03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686903037, "uuid": "580e67b2-fd08-4b89-8f54-a29fc2422b12", "comment": "Malware payload (Mirai)", "value": "b295ba659648365795e2660c1646434abbe271a37cc73b6fb5049c1fdb3ba3e18db415cb1fe184857b38d039edd3c858", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903037, "uuid": "f163a3b8-65c4-4bed-a5a8-a3850baa71ea", "value": "T1E7C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903037, "uuid": "74f65bad-7d99-4f10-afe2-164f10d56405", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP9L7ymm/QMurB1nKGNb:SMQplV9amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686903037, "uuid": "18e79062-6072-4ab6-98e9-aad1f51e36a1", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686903037, "uuid": "7a10dc0a-41ae-4db5-992b-8f30702c84cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686903037, "uuid": "13c5e8c4-72d2-4548-a8d1-822e87ea5174", "value": "1b88f4b5098444a1fddadc33ddb55316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca292b9-0bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686888444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888444, "uuid": "4e8317ba-228a-46f1-a7ef-6aab7923d649", "comment": "Malware payload (RedLineStealer)", "value": "6de454a62338fbbee82a668013f86cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888444, "uuid": "5dc1049a-df18-4d37-82ed-cfc00e595a53", "comment": "Malware payload (RedLineStealer)", "value": "feb9745c210a1b29c662c58f6b69fa8e70e99fe17311555c29591143b4cc6a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888444, "uuid": "dccaeae4-6fcd-4710-a074-e018bafd05ed", "comment": "Malware payload (RedLineStealer)", "value": "bab93bc1485d7bd4803b2239268be9f04506b63e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686888444, "uuid": "8aea76d7-3038-400c-8121-56d5a07a336d", "comment": "Malware payload (RedLineStealer)", "value": "06624216f4b113101899e44392480804284d3b5ba6454f16a126bb4ae5f5cecc9f845be60dd6566c70bf4bd3656aaa6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888444, "uuid": "0c53d755-e94b-4ff6-9d05-07dcaf3a1bb5", "value": "T1EA052256A7DD8073D875377068F60AC30A357C71ADA482572746E88A4CB3B8099B3B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888444, "uuid": "84fb1a0f-a487-4eab-bde1-4078d22ba4f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888444, "uuid": "c2a3afb4-5a2f-4290-be28-c48fd765fa34", "value": "24576:4yzcS8qxyoHWiH7j+agxYDYqFgW3bLF4OX:/ISdxbdH7j+agaDXF794", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686888444, "uuid": "9c8e1ba3-4303-4969-9d44-4d2680881e26", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686888444, "uuid": "a55d15f5-ec4e-47ae-ae20-2d018dad39fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686888444, "uuid": "39d904cf-62b4-4833-aa9b-a4f59f8e1d38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add646a6-0c37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686914377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914377, "uuid": "42f44a10-878a-474d-86f3-42bf266f7595", "comment": "Malware payload (Mirai)", "value": "20cb00954f8d42daee8764c535932b3b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914377, "uuid": "3b24da11-2a86-4349-8c98-78ee13792ad4", "comment": "Malware payload (Mirai)", "value": "ffa847721267285726350e5b5d566df4adb09268d8675865f44680bad5572389", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914377, "uuid": "c68dc34c-5b80-42a9-958f-867002817157", "comment": "Malware payload (Mirai)", "value": "f2398777eb2c58561d23202e1990b97a9d467f72", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686914377, "uuid": "1d7a81c9-e71e-4694-9c69-1f594d45fc71", "comment": "Malware payload (Mirai)", "value": "8f3224ac905f9998e1d719c1dffcc5690628e4f82469814aeb3326e81095ae2a4ec0ed034d0c2db9e87df791978e1143", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914377, "uuid": "d15306af-51e7-476c-a61d-84d5e3ca9c5b", "value": "T1DDD2E151D6F3A2B8C8B39871043D6AA0FC25141297BA475B05CEBCFA99B724C693098B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914377, "uuid": "df874a34-ead3-42a4-95ff-60b007355b77", "value": "768:SYSoXdJZETc51aBfG3MDK81A0Tz2MD81DqW3yiPBSx0s6:SYJdJZiy1aE3u1AaCfMCyiP8t6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686914377, "uuid": "f89d696a-bc76-40e2-96cc-b0636decc6e6", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686914377, "uuid": "2666c095-0774-44a8-8b20-7f8f34cc2976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686914377, "uuid": "9d8d4776-999b-4e86-9579-703ffe76c9e1", "value": "20cb00954f8d42daee8764c535932b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126c5c9d-0c28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686907674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907674, "uuid": "11c8efbb-ed49-4585-9dfb-57faecaabc20", "comment": "Malware payload (Mirai)", "value": "928e4864dfad66a3782746786222058c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907674, "uuid": "9c870145-e17e-4b8a-8c5a-9014cc66248f", "comment": "Malware payload (Mirai)", "value": "fff0f8d4da9c15420cd24d800c7d5b13802a79d36a27a24de3261600a38458a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907674, "uuid": "9ba9272c-0133-46ed-95f1-8814a57362a3", "comment": "Malware payload (Mirai)", "value": "ae3eb3a4090c5d8519b6f6e9c7f91c6f67647bee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686907674, "uuid": "b7b7ed88-6fee-486b-b76b-266246990662", "comment": "Malware payload (Mirai)", "value": "a2f363e7d8c29cb41f35d2d8adf4c3d18dc222858056e9f66e6aa9cd4a78e110c1834de0f793e9126ce801fafe32bae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907674, "uuid": "51d4cd33-4675-4612-9a7f-83c5b2c07ed8", "value": "T1BE13F1B3C914FB71E3B23C30E86EA043A3198F3EE1A9355F132512768A6654795B4A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907674, "uuid": "8e2d9d58-d21d-49a5-930d-669c571292eb", "value": "768:XFeEd6rCV+rPC73Hm2ce8kTDxmUGvccXHtExxcrYgoU4ux1xWRq3UIoj:XFx6o+TC722ce8mVmL0SHaxWMgv401hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686907674, "uuid": "ffc16017-f7c4-4659-b71a-71b890573059", "value": 44972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686907674, "uuid": "2c2b158b-c011-4b4b-a06b-e8011966dbf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686907674, "uuid": "05514f8f-2a80-4191-83ff-247a2db56e70", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.WFL.2918.19933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }